From e80bc45423526ee2cf17349f7601e5894009d862 Mon Sep 17 00:00:00 2001 From: research bot Date: Thu, 13 May 2021 22:09:29 +0000 Subject: [PATCH] updating docs and package bits [ci skip] --- .../account_discovery_with_net_app.yml | 6 +- .../endpoint/cmlua_or_cmstplua_uac_bypass.yml | 10 +- .../endpoint/cobalt_strike_named_pipes.yml | 6 +- .../detect_rclone_command_line_usage.yml | 9 +- detections/endpoint/detect_renamed_rclone.yml | 6 +- .../endpoint/extract_sam_from_registry.yml | 2 +- ..._authenticate_from_host_using_kerberos.yml | 31 +- ..._authenticate_from_host_using_kerberos.yml | 31 +- ...g_to_authenticate_from_host_using_ntlm.yml | 63 +- ...uthenticate_using_explicit_credentials.yml | 65 +- ..._authenticate_from_host_using_kerberos.yml | 28 +- ...g_to_authenticate_from_host_using_ntlm.yml | 31 +- ...s_failing_to_authenticate_from_process.yml | 25 +- ...tely_failing_to_authenticate_from_host.yml | 58 +- ...ice_application_spawn_rundll32_process.yml | 7 +- ...office_document_creating_schedule_task.yml | 10 +- .../office_document_executing_macro_code.yml | 8 +- ...remote_thread_to_known_windows_process.yml | 6 +- .../ransomware_notes_bulk_creation.yml | 2 +- .../registry_keys_used_for_persistence.yml | 4 +- ...ule_task_with_rundll32_command_trigger.yml | 6 +- detections/endpoint/slui_runas_elevated.yml | 9 +- .../endpoint/slui_spawning_a_process.yml | 9 +- detections/endpoint/trickbot_named_pipe.yml | 6 +- ...ss_connecting_to_ip_check_web_services.yml | 6 +- .../wermgr_process_create_executable_file.yml | 6 +- ...cess_spawned_cmd_or_powershell_process.yml | 6 +- .../write_executable_in_smb_share.yml | 6 +- .../delete_shadowcopy_with_powershell.yml | 20 +- dist/escu/app.manifest | 2 +- dist/escu/default/analytic_stories.conf | 195 +- dist/escu/default/analyticstories.conf | 469 +- dist/escu/default/app.conf | 4 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/content-version.conf | 2 +- dist/escu/default/es_investigations.conf | 119 +- dist/escu/default/macros.conf | 106 +- dist/escu/default/savedsearches.conf | 1114 +- dist/escu/default/transforms.conf | 2 +- dist/escu/default/use_case_library.conf | 469 +- dist/escu/lookups/mitre_enrichment.csv | 544 +- dist/saaws/app.manifest | 2 +- dist/saaws/default/analytic_stories.conf | 20 +- dist/saaws/default/analyticstories.conf | 28 +- dist/saaws/default/app.conf | 4 +- dist/saaws/default/collections.conf | 2 +- dist/saaws/default/content-version.conf | 2 +- dist/saaws/default/es_investigations.conf | 10 +- dist/saaws/default/macros.conf | 6 +- dist/saaws/default/savedsearches.conf | 2 +- dist/saaws/default/transforms.conf | 2 +- dist/saaws/default/use_case_library.conf | 28 +- docs/detections.md | 2411 +- docs/detections.wiki | 2261 +- docs/mitre-map/coverage.csv | 57252 +++++++++------- docs/mitre-map/coverage.json | 28626 +++++--- docs/mitre-map/detections.csv | 33252 +++++---- docs/mitre-map/detections.json | 52713 +++++++------- docs/stories.md | 244 +- docs/stories.wiki | 341 +- 60 files changed, 104432 insertions(+), 76284 deletions(-) diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index 748ec8b65a..d6b9650a94 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -32,6 +32,9 @@ references: tags: analytic_story: - Trickbot + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -51,6 +54,3 @@ tags: - Processes.dest - Processes.user security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index ddf8ffa9ac..e6c7b05114 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -7,8 +7,8 @@ type: batch datamodel: - Endpoint description: This analytic detects a potential process using COM Object like CMLUA - or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative - privileges to its running process. + or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries + to gain administrative privileges to its running process. search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime @@ -25,6 +25,9 @@ tags: analytic_story: - DarkSide Ransomware - Ransomware + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -43,6 +46,3 @@ tags: - Signed - ProcessId security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon.log diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index 4ebce333a1..4ca9db964b 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -19,9 +19,9 @@ description: 'The following analytic identifies the use of default or publicly k connection, review and follow the connection back to identify any file modifications.' search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*, \\srvsvc_*, \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, - \\ntsvcs*, \\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time) as lastTime - by Computer, process_name, process_id process_path, PipeName | rename Computer as - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + \\ntsvcs*, \\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time) + as lastTime by Computer, process_name, process_id process_path, PipeName | rename + Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cobalt_strike_named_pipes_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index 7be4dd0dea..af35807b1c 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -18,11 +18,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `detect_rclone_command_line_usage_filter`' + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -36,6 +33,7 @@ tags: analytic_story: - DarkSide Ransomware - Ransomware + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log kill_chain_phases: @@ -56,4 +54,3 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index e6f10f60b1..564bf81adb 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -14,9 +14,7 @@ description: The following analytic identifies the usage of `rclone.exe`, rename search: '`sysmon` EventID=1 OriginalFileName=rclone.exe NOT process_name=rclone.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine | - rename Computer as dest - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_rclone_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -33,6 +31,7 @@ tags: analytic_story: - DarkSide Ransomware - Ransomware + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log kill_chain_phases: @@ -51,4 +50,3 @@ tags: - CommandLine - dest security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/extract_sam_from_registry.yml b/detections/endpoint/extract_sam_from_registry.yml index 4f84d7050f..cd9101f63c 100644 --- a/detections/endpoint/extract_sam_from_registry.yml +++ b/detections/endpoint/extract_sam_from_registry.yml @@ -29,6 +29,7 @@ tags: analytic_story: - DarkSide Ransomware - Credential Dumping + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log kill_chain_phases: @@ -49,4 +50,3 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml index 3ba03e214a..bf8a988ea7 100644 --- a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -11,18 +11,22 @@ description: 'The following analytic identifies one source endpoint failing to a represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may - execute a password spraying attack against disabled users. Event 4768 is generated every time - the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for - `clients credentials have been revoked` (account disabled, expired or locked out).\ + execute a password spraying attack against disabled users. Event 4768 is generated + every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket + (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account + disabled, expired or locked out).\ - The detection calculates the standard deviation for each host and leverages - the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, - users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. - This logic can be used for real time security monitoring as well as threat hunting exercises.\ + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ - This detection will only trigger on domain controllers, not on member servers or workstations.\ + This detection will only trigger on domain controllers, not on member servers or + workstations.\ - The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' + The analytics returned fields allow analysts to investigate the event further by + providing fields like source ip and attempted user accounts.' search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as @@ -34,12 +38,16 @@ how_to_implement: To successfully implement this search, you need to be ingestin `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. known_false_positives: A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios - include but are not limited to vulnerability scanners, multi-user systems missconfigured systems. + include but are not limited to vulnerability scanners, multi-user systems missconfigured + systems. references: - https://attack.mitre.org/techniques/T1110/003/ tags: analytic_story: - Active Directory Password Spraying + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -55,6 +63,3 @@ tags: - Account_Name - Client_Address security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml index cb357e355b..7b786d699f 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -11,18 +11,22 @@ description: 'The following analytic identifies one source endpoint failing to a represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may - execute a password spraying attack using an invalid list of users. Event 4768 is generated - every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). - Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ + execute a password spraying attack using an invalid list of users. Event 4768 is + generated every time the Key Distribution Center issues a Kerberos Ticket Granting + Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` + (the attempted user is not a valid domain user).\ - The detection calculates the standard deviation for each host and leverages - the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, - users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. - This logic can be used for real time security monitoring as well as threat hunting exercises.\ + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ - This detection will only trigger on domain controllers, not on member servers or workstations.\ + This detection will only trigger on domain controllers, not on member servers or + workstations.\ - The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' + The analytics returned fields allow analysts to investigate the event further by + providing fields like source ip and attempted user accounts.' search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as @@ -34,12 +38,16 @@ how_to_implement: To successfully implement this search, you need to be ingestin `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. known_false_positives: A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios - include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems. + include but are not limited to vulnerability scanners, multi-user systems and missconfigured + systems. references: - https://attack.mitre.org/techniques/T1110/003/ tags: analytic_story: - Active Directory Password Spraying + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -55,6 +63,3 @@ tags: - Account_Name - Client_Address security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml index 2ae0ec1b18..a0d0f5fae7 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -6,33 +6,42 @@ author: Mauricio Velazco, Splunk type: batch datamodel: - Endpoint -description: 'The following analytic identifies one source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. - This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain - initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. - Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. - For local accounts, the local computer is authoritative. Error code 0xC0000064 stands for `The username you typed does not exist` (the attempted user is a legitimate domain user).\ - - The detection calculates the standard deviation for each host and leverages - the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, - users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. - This logic can be used for real time security monitoring as well as threat hunting exercises.\ +description: 'The following analytic identifies one source endpoint failing to authenticate + with multiple invalid users using the NTLM protocol. This behavior could represent + an adversary performing a Password Spraying attack against an Active Directory environment + using NTLM to obtain initial access or elevate privileges. As attackers progress + in a breach, mistakes will be made. In certain scenarios, adversaries may execute + a password spraying attack using an invalid list of users. Event 4776 is generated + on the computer that is authoritative for the provided credentials. For domain accounts, + the domain controller is authoritative. For local accounts, the local computer is + authoritative. Error code 0xC0000064 stands for `The username you typed does not + exist` (the attempted user is a legitimate domain user).\ - This detection will only trigger on domain controllers, not on member servers or workstations.\ + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ - The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure - | bucket span=2m _time - | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation - | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation - | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 - | `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential + This detection will only trigger on domain controllers, not on member servers or + workstations.\ + + The analytics returned fields allow analysts to investigate the event further by + providing fields like source workstation name and attempted user accounts.' +search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure + | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) + as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) + as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled. -known_false_positives: A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios - include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could - represent a password spraying attack against the host's local accounts. +known_false_positives: A host failing to authenticate with multiple invalid domain + users is not a common behavior for legitimate systems. Possible false positive scenarios + include but are not limited to vulnerability scanners and missconfigured systems. + If this detection triggers on a host other than a Domain Controller, the behavior + could represent a password spraying attack against the host's local accounts. references: - https://attack.mitre.org/techniques/T1110/003/ - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation @@ -40,6 +49,9 @@ references: tags: analytic_story: - Active Directory Password Spraying + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -55,6 +67,3 @@ tags: - Logon_Account - Source_Workstation security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log diff --git a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml index 8999955b61..f55f42d909 100644 --- a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml @@ -6,34 +6,43 @@ author: Mauricio Velazco, Splunk type: batch datamodel: - Endpoint -description: 'The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. - This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. - Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ +description: 'The following analytic identifies a source user failing to authenticate + with multiple users using explicit credentials on a host. This behavior could represent + an adversary performing a Password Spraying attack against an Active Directory environment + to obtain initial access or elevate privileges. Event 4648 is generated when a process + attempts an account logon by explicitly specifying that accounts credentials. This + event generates on domain controllers, member servers, and workstations.\ - The detection calculates the standard deviation for each host and leverages - the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, - users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. - This logic can be used for real time security monitoring as well as threat hunting exercises.\ + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ - This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ + This detection will trigger on the potenfially malicious host, perhaps controlled + via a trojan or operated by an insider threat, from where a password spraying attack + is being executed.\ - The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.' -search: ' `wineventlog_security` EventCode=4648 - | bucket span=2m _time - | eval Source_Account = mvindex(Account_Name, 0) - | eval Destination_Account = mvindex(Account_Name, 1) - | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" - | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account - | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName - | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 - | `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` ' -how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as - well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. -known_false_positives: A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. - Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. - Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. + The analytics returned fields allow analysts to investigate the event further by + providing fields like source account, attempted user accounts and the endpoint were + the behavior was identified.' +search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account + = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) + | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" + | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as + tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts) + as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 | `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers as well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: A source user failing attempting to authenticate multiple users + on a host is not a common behavior for regular systems. Some applications, however, + may exhibit this behavior in which case sets of users hosts can be added to an allow + list. Possible false positive scenarios include systems where several users connect + to like Mail servers, identity providers, remote desktop services, Citrix, etc. references: - https://attack.mitre.org/techniques/T1110/003/ - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648 @@ -41,6 +50,9 @@ references: tags: analytic_story: - Active Directory Password Spraying + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -56,6 +68,3 @@ tags: - Account_Name - ComputerName security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml index e5cf6b75a4..4c2e2a99dc 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -9,18 +9,22 @@ datamodel: description: 'The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment - using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when - the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code - 0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\ + using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated + when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket + (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user + is a legitimate domain user).\ - The detection calculates the standard deviation for each host and leverages - the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, - users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. - This logic can be used for real time security monitoring as well as threat hunting exercises.\ + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ - This detection will only trigger on domain controllers, not on member servers or workstations.\ + This detection will only trigger on domain controllers, not on member servers or + workstations.\ - The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' + The analytics returned fields allow analysts to investigate the event further by + providing fields like source ip and attempted user accounts.' search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$" | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as @@ -41,6 +45,9 @@ references: tags: analytic_story: - Active Directory Password Spraying + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -56,6 +63,3 @@ tags: - Account_Name - Client_Address security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml index e58c223ac8..274a1842c1 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -9,20 +9,23 @@ datamodel: description: 'The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment - using NTLM to obtain initial access or elevate privileges. Event 4776 is generated on the - computer that is authoritative for - the provided credentials. For domain accounts, the domain controller is authoritative. - For local accounts, the local computer is authoritative. Error code 0xC000006A means: - misspelled or bad password (the attempted user is a legitimate domain user).\ + using NTLM to obtain initial access or elevate privileges. Event 4776 is generated + on the computer that is authoritative for the provided credentials. For domain accounts, + the domain controller is authoritative. For local accounts, the local computer is + authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted + user is a legitimate domain user).\ - The detection calculates the standard deviation for each host and leverages - the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, - users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. - This logic can be used for real time security monitoring as well as threat hunting exercises.\ + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ - This detection will only trigger on domain controllers, not on member servers or workstations.\ + This detection will only trigger on domain controllers, not on member servers or + workstations.\ - The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.' + The analytics returned fields allow analysts to investigate the event further by + providing fields like source workstation name and attempted user accounts.' search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) @@ -44,6 +47,9 @@ references: tags: analytic_story: - Active Directory Password Spraying + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -59,6 +65,3 @@ tags: - Logon_Account - Source_Workstation security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml index cd6474499d..d55bdf301c 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml @@ -9,22 +9,23 @@ datamodel: description: 'The following analytic identifies a source process name failing to authenticate with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access - or elevate privileges. Event 4625 generates - on domain controllers, member servers, and workstations when an account fails to logon. Logon Type 2 describes - an iteractive logon attempt.\ + or elevate privileges. Event 4625 generates on domain controllers, member servers, + and workstations when an account fails to logon. Logon Type 2 describes an iteractive + logon attempt.\ - The detection calculates the standard deviation for each host and leverages - the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, - users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. - This logic can be used for real time security monitoring as well as threat hunting exercises.\ + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed. This could be a domain controller as well as a member server or workstation.\ - The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user - accounts.' + The analytics returned fields allow analysts to investigate the event further by + providing fields like source process name, source account and attempted user accounts.' search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-" | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name) @@ -48,6 +49,9 @@ references: tags: analytic_story: - Active Directory Password Spraying + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -65,6 +69,3 @@ tags: - Account_Name - ComputerName security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml index 0dcf433565..89e2d6078d 100644 --- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml +++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml @@ -6,32 +6,40 @@ author: Mauricio Velazco, Splunk type: batch datamodel: - Endpoint -description: The following analytic identifies a source host failing to authenticate against a remote host with multiple users. This behavior could represent an adversary - performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. - Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 - describes an remote authentication attempt.\ +description: 'The following analytic identifies a source host failing to authenticate + against a remote host with multiple users. This behavior could represent an adversary + performing a Password Spraying attack against an Active Directory environment to + obtain initial access or elevate privileges. Event 4625 documents each and every + failed attempt to logon to the local computer. This event generates on domain controllers, + member servers, and workstations. Logon Type 3 describes an remote authentication + attempt.\ - The detection calculates the standard deviation for each host and leverages - the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, - users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. - This logic can be used for real time security monitoring as well as threat hunting exercises.\ + The detection calculates the standard deviation for each host and leverages the + 3-sigma statistical rule to identify an unusual number of users. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ - This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server or workstation.\ + This detection will trigger on the host that is the target of the password spraying + attack. This could be a domain controller as well as a member server or workstation.\ - The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. + The analytics returned fields allow analysts to investigate the event further by + providing fields like source process name, source account and attempted user accounts.' search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-" - | bucket span=2m _time - | eval Destination_Account = mvindex(Account_Name, 1) - | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts by _time, Source_Network_Address, ComputerName - | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName - | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 - | `multiple_users_remotely_failing_to_authenticate_from_host_filter` ' -how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as - as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. -known_false_positives: A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. - Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc. + | bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats + dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts + by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts) + as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 + and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` ' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows Event Logs from domain controllers as as well as member servers and workstations. + The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs + to be enabled. +known_false_positives: A host failing to authenticate with multiple valid users against + a remote host is not a common behavior for legitimate systems. Possible false positive + scenarios include but are not limited to vulnerability scanners, remote administration + tools, missconfigyred systems, etc. references: - https://attack.mitre.org/techniques/T1110/003/ - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 @@ -40,6 +48,9 @@ references: tags: analytic_story: - Active Directory Password Spraying + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -57,6 +68,3 @@ tags: - ComputerName - Source_Network_Address security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index c1664fec36..ed6fda6d58 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -13,10 +13,9 @@ description: this detection was designed to identifies suspicious spawned proces search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name - = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") - Processes.process_name=rundll32.exe by Processes.parent_process - Processes.process_name Processes.process_id Processes.process_guid Processes.user - Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` + = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") Processes.process_name=rundll32.exe by + Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid + Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `office_application_spawn_rundll32_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index bd66ddc533..05a7c48c42 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -19,11 +19,11 @@ description: this search detects a potential malicious office document that crea source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") - ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime - max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode - Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter`' +search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") + ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime + values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name + ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `office_document_creating_schedule_task_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index b72b4aefb4..f10e0baf8e 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -13,10 +13,10 @@ description: this detection was designed to identifies suspicious office documen or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") - ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") - | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded - count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` +search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") + ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) + as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count + by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index 2ce7201b9d..29267de07f 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -27,6 +27,9 @@ references: tags: analytic_story: - Trickbot + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -48,6 +51,3 @@ tags: - Computer - EventCode security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index 9260b44103..ace3740572 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -46,4 +46,4 @@ tags: - Computer - Image - user - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index b585325c63..693447fe95 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -4,8 +4,8 @@ version: 5 date: '2020-11-27' author: David Dorsey, Splunk type: batch -datamodel: - - Endpoint +datamodel: +- Endpoint description: The search looks for modifications to registry keys that can be used to launch an application or service at system startup. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml index 4a054d44b5..4a04c6f7d4 100644 --- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -35,6 +35,9 @@ tags: analytic_story: - Windows Persistence Techniques - Trickbot + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -53,6 +56,3 @@ tags: - Hidden - Arguments security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log diff --git a/detections/endpoint/slui_runas_elevated.yml b/detections/endpoint/slui_runas_elevated.yml index 6958a8b244..6b145f4359 100644 --- a/detections/endpoint/slui_runas_elevated.yml +++ b/detections/endpoint/slui_runas_elevated.yml @@ -16,11 +16,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime from datamodel=Endpoint.Processes where Processes.process_name=slui.exe (Processes.process=*-verb* Processes.process=*runas*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `slui_runas_elevated_filter`' + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `slui_runas_elevated_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -36,6 +33,7 @@ tags: analytic_story: - DarkSide Ransomware - Windows Defense Evasion Tactics + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log kill_chain_phases: @@ -56,4 +54,3 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml index e2e2b4b8c2..ad24b7c016 100644 --- a/detections/endpoint/slui_spawning_a_process.yml +++ b/detections/endpoint/slui_spawning_a_process.yml @@ -16,11 +16,8 @@ description: The following analytic identifies the Microsoft Software Licensing search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=slui.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `slui_spawning_a_process_filter`' + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `slui_spawning_a_process_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -34,6 +31,7 @@ tags: analytic_story: - DarkSide Ransomware - Windows Defense Evasion Tactics + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log kill_chain_phases: @@ -54,4 +52,3 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml index 6296d6fc9b..47bee135a7 100644 --- a/detections/endpoint/trickbot_named_pipe.yml +++ b/detections/endpoint/trickbot_named_pipe.yml @@ -23,6 +23,9 @@ references: tags: analytic_story: - Trickbot + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -41,6 +44,3 @@ tags: - Image - process_id security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml index 693331f4be..d1792692f1 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -31,6 +31,9 @@ references: tags: analytic_story: - Trickbot + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -50,6 +53,3 @@ tags: - Computer - EventCode security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml index 9f1862211d..2fc9acb437 100644 --- a/detections/endpoint/wermgr_process_create_executable_file.yml +++ b/detections/endpoint/wermgr_process_create_executable_file.yml @@ -27,6 +27,9 @@ references: tags: analytic_story: - Trickbot + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -44,6 +47,3 @@ tags: - EventCode - ProcessId security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml index d3fa042588..f41695c398 100644 --- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml +++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml @@ -28,6 +28,9 @@ references: tags: analytic_story: - Trickbot + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -47,6 +50,3 @@ tags: - Processes.dest - Processes.user security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log diff --git a/detections/endpoint/write_executable_in_smb_share.yml b/detections/endpoint/write_executable_in_smb_share.yml index d48051c4d8..52e1962464 100644 --- a/detections/endpoint/write_executable_in_smb_share.yml +++ b/detections/endpoint/write_executable_in_smb_share.yml @@ -25,6 +25,9 @@ references: tags: analytic_story: - Trickbot + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log kill_chain_phases: - Lateral Movement mitre_attack_id: @@ -44,6 +47,3 @@ tags: - src_port - Source_Address security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log diff --git a/detections/experimental/delete_shadowcopy_with_powershell.yml b/detections/experimental/delete_shadowcopy_with_powershell.yml index d16f7441d3..3ea98860a7 100644 --- a/detections/experimental/delete_shadowcopy_with_powershell.yml +++ b/detections/experimental/delete_shadowcopy_with_powershell.yml @@ -6,16 +6,18 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. - This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded - command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. -search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" -| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `delete_shadowcopy_with_powershell_filter`' +description: This following analytic detects PowerShell command to delete shadow copy + using the WMIC PowerShell module. This technique was seen used by a recent adversary + to deploy DarkSide Ransomware where it executed a child process of PowerShell to + execute a hex encoded command to delete shadow copy. This hex encoded command was + able to be decrypted by PowerShell log. +search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `delete_shadowcopy_with_powershell_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. known_false_positives: unknown references: - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest index 57b3aad7cd..1912ecfddb 100644 --- a/dist/escu/app.manifest +++ b/dist/escu/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "3.20.0" + "version": "3.21.0" }, "author": [ { diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index 9f4686d3e6..bd7f20771e 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-04-29T21:10:45 UTC +# On Date: 2021-05-13T21:46:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -35,8 +35,8 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} -investigative_searches = ["ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] -support_searches = ["ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen EC2 AMIs", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen EC2 Instance Types"] +investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +support_searches = ["ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 AMIs", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 Launches By User"] data_models = [] providing_technologies = none description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior. @@ -73,7 +73,7 @@ version = 2 reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] detection_searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"] mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1562.007"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC"]} -investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of Network ACL Activity by ARN", "ESCU - Baseline of blocked outbound traffic from AWS"] data_models = [] providing_technologies = none @@ -107,7 +107,7 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule"] mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} -investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get All AWS Activity From Region - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get All AWS Activity From Region - Response Task"] support_searches = ["ESCU - Previously Seen AWS Provisioning Activity Sources"] data_models = [] providing_technologies = none @@ -125,8 +125,8 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] detection_searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule"] mappings = {"cis20": ["CIS 1", "CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1526"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]} -investigative_searches = ["ESCU - Investigate AWS User Activities by user field - Response Task", "ESCU - Get Notable History - Response Task"] -support_searches = ["ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of API Calls per User ARN", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Previously seen API call per user roles in CloudTrail"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +support_searches = ["ESCU - Baseline of API Calls per User ARN", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Create a list of approved AWS service accounts", "ESCU - Previously seen API call per user roles in CloudTrail"] data_models = [] providing_technologies = none description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. @@ -136,6 +136,25 @@ Fortunately, you can leverage Amazon Web Services (AWS) CloudTrail--a tool that The detection searches in this Analytic Story are designed to help you uncover AWS API activities from users not listed in the identity table, as well as similar activities from disabled accounts. product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] +[Active Directory Password Spraying] +category = Adversary Tactics +creation_date = 2021-04-07 +modification_date = 2021-04-07 +id = 3de109da-97d2-11eb-8b6a-acde48001122 +version = 1 +reference = ["https://attack.mitre.org/techniques/T1110/003/", "https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/", "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)"] +detection_searches = ["ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Failing To Authenticate From Process - Rule", "ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule"] +mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +investigative_searches = [] +support_searches = [] +data_models = [] +providing_technologies = none +description = Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments. +narrative = In a password spraying attack, adversaries leverage one or a small list of commonly used / popular passwords against a large volume of usernames to acquire valid account credentials. Unlike a Brute Force attack that targets a specific user or small group of users with a large number of passwords, password spraying follows the opposite aproach and increases the chances of obtaining valid credentials while avoiding account lockouts. This allows adversaries to remain undetected if the target organization does not have the proper monitoring and detection controls in place.\ +Password Spraying can be leveraged by adversaries across different stages in an attack. It can be used to obtain an iniial access to an environment but can also be used to escalate privileges when access has been already achieved. In some scenarios, this technique capitalizes on a security policy most organizations implement, password rotation. As enterprise users change their passwords, it is possible some pick predictable, seasonal passwords such as `$CompanyNameWinter`, `Summer2021`, etc.\ +Specifically, this Analytic Story is focused on detecting possible Password Spraying attacks against Active Directory environments leveraging Windows Event Logs in the `Account Logon` and `Logon/Logoff` Advanced Audit Policy categories. It presents 9 detection analytics which can aid defenders in identifyng instances where one source user, source host or source process attempts to authenticate against a target or targets using a high, unsual, number of unique users. A user, host or process attempting to authenticate with multiple users is not common behavior for legitimate systems and should be monitored by security teams. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, multi-user systems and missconfigured systems. These should be easily spotted when first implementing the detection and addded to an allow list or lookup table. The presented detections can also be used in Threat Hunting exercises. +product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] + [Apache Struts Vulnerability] category = Vulnerability creation_date = 2018-12-06 @@ -145,7 +164,7 @@ version = 1 reference = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] detection_searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"] mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 3", "CIS 4", "CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT", "RS.MI"]} -investigative_searches = ["ESCU - Investigate Web POSTs From src - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -226,7 +245,7 @@ version = 1 reference = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"] detection_searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"] mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery"], "nist": ["PR.IP"]} -investigative_searches = ["ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Email Info - Response Task"] +investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - DNSTwist Domain Names"] data_models = ["Email", "Network_Resolution", "Web"] providing_technologies = none @@ -262,8 +281,8 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} -investigative_searches = ["ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] -support_searches = ["ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Previously Seen Cloud Regions - Update", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Baseline Of Cloud Instances Launched"] +investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Previously Seen Cloud Regions - Update"] data_models = ["Change"] providing_technologies = none description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. @@ -325,7 +344,7 @@ version = 1 reference = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"] detection_searches = ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule"] mappings = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control", "Installation"], "nist": ["DE.CM", "DE.DP", "PR.PT"]} -investigative_searches = ["ESCU - Investigate Network Traffic From src ip - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -344,7 +363,7 @@ version = 1 reference = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] detection_searches = ["ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule"] mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036", "T1114.001", "T1114.002"], "nist": ["DE.AE", "DE.CM", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] data_models = ["Endpoint", "Network_Traffic"] providing_technologies = none @@ -363,8 +382,8 @@ version = 1 reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"] detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] mappings = {"cis20": ["CIS 1", "CIS 11", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation"], "mitre_attack": ["T1048", "T1048.003", "T1071.001", "T1071.004", "T1095", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] -support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of DNS Query Length - MLTK"] +investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of blocked outbound traffic from AWS"] data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"] providing_technologies = none description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. @@ -414,9 +433,9 @@ modification_date = 2020-02-04 id = 854d78bf-d0e2-4f4e-b05c-640905f86d7a version = 3 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] -detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] -mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1003.001", "T1003.002", "T1003.003", "T1059.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]} -investigative_searches = ["ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] +detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] +mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"], "mitre_attack": ["T1003.001", "T1003.002", "T1003.003", "T1059.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]} +investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -435,7 +454,7 @@ version = 2 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"] mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1021.002", "T1053.005", "T1059.001", "T1059.003", "T1071.002", "T1112", "T1136.001", "T1204.002", "T1543.003", "T1547.001", "T1562.004"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] data_models = ["Endpoint", "Network_Traffic"] providing_technologies = none @@ -473,7 +492,7 @@ version = 1 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - DNS Hijack Enrichment - Response Task"] +investigative_searches = ["ESCU - DNS Hijack Enrichment - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] support_searches = ["ESCU - Discover DNS records"] data_models = ["Network_Resolution"] providing_technologies = none @@ -489,6 +508,23 @@ In DNS hijacking, the attacker assumes control over an account or makes use of a The searches in this Analytic Story help you detect and investigate activities that may indicate that DNS hijacking has taken place within your environment. product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] +[DarkSide Ransomware] +category = Malware +creation_date = 2020-06-12 +modification_date = 2020-06-12 +id = 507edc74-13d5-4339-878e-b9114ded1f35 +version = 1 +reference = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"] +detection_searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule"] +mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exfiltration", "Exploitation", "Obfuscation"], "mitre_attack": ["T1003.001", "T1003.002", "T1020", "T1021.002", "T1055", "T1105", "T1197", "T1218.003", "T1486", "T1490", "T1548.002"], "nist": ["DE.AE", "DE.CM", "PR.PT"]} +investigative_searches = [] +support_searches = [] +data_models = ["Endpoint"] +providing_technologies = none +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware +narrative = This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload. +product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] + [Data Exfiltration] category = Adversary Tactics creation_date = 2020-10-21 @@ -515,7 +551,7 @@ version = 1 reference = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"] detection_searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1048.003", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]} -investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = [] data_models = ["Change_Analysis", "Network_Resolution"] providing_technologies = none @@ -566,7 +602,7 @@ version = 2 reference = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"] detection_searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1112", "T1543.003", "T1553.004", "T1562.001", "T1562.004"], "nist": ["DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] data_models = ["Endpoint"] providing_technologies = none @@ -600,7 +636,7 @@ version = 2 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1048", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = [] data_models = ["Endpoint", "Network_Resolution", "Web"] providing_technologies = none @@ -617,7 +653,7 @@ version = 1 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"] detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] mappings = {"cis20": ["CIS 12", "CIS 2", "CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Installation"], "mitre_attack": ["T1021.002", "T1059.003", "T1072", "T1547.001", "T1566.001"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = ["ESCU - Baseline of SMB Traffic - MLTK"] data_models = ["Email", "Endpoint", "Network_Traffic"] providing_technologies = none @@ -691,8 +727,8 @@ version = 2 reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"] detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule"] mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1021.001", "T1021.002", "T1048.003", "T1059.001", "T1059.003", "T1070.005", "T1071.002", "T1071.004"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] -support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments", "ESCU - Baseline of DNS Query Length - MLTK"] +investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"] providing_technologies = none description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. @@ -776,7 +812,7 @@ version = 1 reference = ["https://github.com/splunk/cloud-datamodel-security-research"] detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule"] mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} -investigative_searches = ["ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -827,7 +863,7 @@ version = 2 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"] mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001", "T1053.005", "T1550.002", "T1558.003"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] support_searches = [] data_models = ["Endpoint", "Network_Traffic"] providing_technologies = none @@ -848,7 +884,7 @@ version = 4 reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule"] mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation", "Installation"], "mitre_attack": ["T1027", "T1059.001"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -910,7 +946,7 @@ version = 1 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] detection_searches = ["ESCU - Prohibited Software On Endpoint - Rule"] mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "nist": ["ID.AM", "PR.DS"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -964,7 +1000,7 @@ version = 1 reference = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"] detection_searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["DE.CM", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] data_models = ["Endpoint"] providing_technologies = none @@ -999,8 +1035,8 @@ version = 2 reference = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"] detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1059.001", "T1059.003", "T1543.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] -support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously seen command line arguments", "ESCU - Previously Seen Running Windows Services - Update"] +investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update", "ESCU - Previously seen command line arguments"] data_models = ["Endpoint"] providing_technologies = none description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. @@ -1019,8 +1055,8 @@ version = 1 reference = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"] detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1059.001", "T1059.003", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] -support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"] +investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"] data_models = ["Endpoint"] providing_technologies = none description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. @@ -1063,7 +1099,7 @@ version = 1 reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1048", "T1048.003", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.DS", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = [] data_models = ["Network_Resolution", "Network_Traffic"] providing_technologies = none @@ -1078,10 +1114,10 @@ modification_date = 2020-02-04 id = cf309d0d-d4aa-4fbb-963d-1e79febd3756 version = 1 reference = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] -detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"] -mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1021.002", "T1036.003", "T1047", "T1048", "T1053.005", "T1070", "T1070.001", "T1071.001", "T1485", "T1490", "T1547.001"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task"] -support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Baseline of Command Line Length - MLTK"] +detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"] +mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1020", "T1021.002", "T1036.003", "T1047", "T1048", "T1053.005", "T1070", "T1070.001", "T1071.001", "T1218.003", "T1485", "T1490", "T1547.001"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} +investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK"] data_models = ["Endpoint", "Network_Traffic"] providing_technologies = none description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. @@ -1167,7 +1203,7 @@ version = 1 reference = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] detection_searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"] mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 16", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Installation", "Reconnaissance"], "mitre_attack": ["T1021.001", "T1021.002", "T1082", "T1204.002", "T1485", "T1486", "T1490"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.DS", "PR.IP", "PR.MA", "PR.PT"]} -investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task"] +investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] support_searches = [] data_models = ["Endpoint", "Network_Traffic", "Web"] providing_technologies = none @@ -1273,7 +1309,7 @@ version = 1 reference = ["https://nvd.nist.gov/vuln/detail/CVE-2018-11409", "https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings", "https://www.exploit-db.com/exploits/44865/"] detection_searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule"] mappings = {"cis20": ["CIS 18", "CIS 3", "CIS 4"], "kill_chain_phases": ["Delivery"], "nist": ["DE.CM", "ID.RA", "PR.AC", "PR.IP", "PR.PT", "RS.MI"]} -investigative_searches = ["ESCU - Investigate Network Traffic From src ip - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -1293,7 +1329,7 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} -investigative_searches = ["ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] +investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] support_searches = ["ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User"] data_models = [] providing_technologies = none @@ -1327,8 +1363,8 @@ version = 2 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] detection_searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule"] mappings = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "DE.DP", "PR.AC", "PR.DS"]} -investigative_searches = ["ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] -support_searches = ["ESCU - Previously seen S3 bucket access by remote IP", "ESCU - Baseline of S3 Bucket deletion activity by ARN"] +investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +support_searches = ["ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Previously seen S3 bucket access by remote IP"] data_models = [] providing_technologies = none description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. @@ -1346,7 +1382,7 @@ version = 1 reference = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"] detection_searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"] mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"]} -investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS"] data_models = [] providing_technologies = none @@ -1366,8 +1402,8 @@ version = 1 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"] mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.AE", "DE.DP", "PR.AC", "PR.DS"]} -investigative_searches = ["ESCU - Investigate AWS User Activities by user field - Response Task", "ESCU - Get Notable History - Response Task"] -support_searches = ["ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen Users in CloudTrail - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users In CloudTrail - Update"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +support_searches = ["ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users In CloudTrail - Update", "ESCU - Previously Seen Users in CloudTrail - Initial"] data_models = ["Authentication"] providing_technologies = none description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. @@ -1385,7 +1421,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule"] mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] -support_searches = ["ESCU - Previously Seen Cloud Instance Modifications By User - Update", "ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Baseline Of Cloud Instances Launched"] +support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"] data_models = ["Change"] providing_technologies = none description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. @@ -1402,7 +1438,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p detection_searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"] mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] -support_searches = ["ESCU - Previously Seen Cloud Provisioning Activity Sources - Update", "ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial"] +support_searches = ["ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial", "ESCU - Previously Seen Cloud Provisioning Activity Sources - Update"] data_models = ["Change"] providing_technologies = none description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. @@ -1420,7 +1456,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p detection_searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"] mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "mitre_attack": ["T1078", "T1078.004", "T1580"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"] -support_searches = ["ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Baseline Of Cloud Security Group API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Update", "ESCU - Baseline Of Cloud Infrastructure API Calls Per User"] +support_searches = ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User", "ESCU - Baseline Of Cloud Security Group API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Previously Seen Cloud API Calls Per User Role - Update"] data_models = ["Change"] providing_technologies = none description = Detect and investigate suspicious activities by users and roles in your cloud environments. @@ -1437,8 +1473,8 @@ version = 2 reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"] detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1036.003", "T1059.001", "T1059.003"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] -support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"] data_models = ["Endpoint"] providing_technologies = none description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. @@ -1454,7 +1490,7 @@ version = 1 reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"] detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1048", "T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of DNS Query Length - MLTK"] data_models = ["Endpoint", "Network_Resolution"] providing_technologies = none @@ -1471,7 +1507,7 @@ version = 1 reference = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"] detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] mappings = {"cis20": ["CIS 12", "CIS 3", "CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.AE", "PR.IP"]} -investigative_searches = ["ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Email Info - Response Task"] +investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - DNSTwist Domain Names"] data_models = ["Email", "UEBA"] providing_technologies = none @@ -1509,8 +1545,8 @@ version = 2 reference = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"] detection_searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059.003", "T1218.005", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] -support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"] data_models = ["Endpoint"] providing_technologies = none description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. @@ -1538,7 +1574,7 @@ version = 1 reference = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"] detection_searches = ["ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule"] mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} -investigative_searches = ["ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task"] +investigative_searches = ["ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -1591,7 +1627,7 @@ version = 2 reference = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"] detection_searches = ["ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047", "T1546.003"], "nist": ["PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1610,7 +1646,7 @@ version = 1 reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"] detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001", "T1546.011", "T1546.012", "T1547.001", "T1547.010", "T1548.002", "T1564.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1638,6 +1674,23 @@ narrative = Zoom is a leader in modern enterprise video communications and its u Current detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation. product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] +[Trickbot] +category = Malware +creation_date = 2021-04-20 +modification_date = 2021-04-20 +id = 16f93769-8342-44c0-9b1d-f131937cce8e +version = 1 +reference = ["https://en.wikipedia.org/wiki/Trickbot", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"] +detection_searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Powershell Remote Thread To Known Windows Process - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Trickbot Named Pipe - Rule", "ESCU - Wermgr Process Connecting To IP Check Web Services - Rule", "ESCU - Wermgr Process Create Executable File - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Write Executable in SMB Share - Rule"] +mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Lateral Movement"], "mitre_attack": ["T1021.002", "T1027", "T1053", "T1055", "T1059", "T1087.002", "T1218.011", "T1562.001", "T1566.001", "T1590.005"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} +investigative_searches = [] +support_searches = [] +data_models = ["Endpoint"] +providing_technologies = none +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment. +narrative = trickbot banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS where target security Microsoft Defender to prevent its detection and removal. steal Verizon credentials and targeting banks using its multi component modules that collect and exfiltrate data. +product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] + [Trusted Developer Utilities Proxy Execution] category = Adversary Tactics creation_date = 2021-01-12 @@ -1713,7 +1766,7 @@ version = 2 reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1016", "T1036.003", "T1204.002", "T1218.011"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK"] data_models = ["Endpoint"] providing_technologies = none @@ -1732,7 +1785,7 @@ version = 1 reference = ["https://www.monkey.org/~dugsong/dsniff/"] detection_searches = ["ESCU - Protocols passing authentication in cleartext - Rule"] mappings = {"cis20": ["CIS 14", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "nist": ["DE.AE", "PR.AC", "PR.DS", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = [] data_models = ["Network_Traffic"] providing_technologies = none @@ -1749,7 +1802,7 @@ version = 1 reference = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"] detection_searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule"] mappings = {"cis20": ["CIS 16", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078", "T1136"], "nist": ["DE.AE", "DE.CM", "DE.DP"]} -investigative_searches = ["ESCU - Get Web Session Information via session id - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] +investigative_searches = ["ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Web Session Information via session id - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -1786,9 +1839,9 @@ modification_date = 2018-05-31 id = 56e24a28-5003-4047-b2db-e8f3c4618064 version = 1 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"] -detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"] +detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1222.001", "T1548.002", "T1562.001", "T1564.001"], "nist": ["DE.CM", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1805,7 +1858,7 @@ version = 1 reference = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"] detection_searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious Changes to File Associations - Rule"] mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003", "T1546.001"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1826,7 +1879,7 @@ version = 2 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"] detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"] mappings = {"cis20": ["CIS 10", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001", "T1490"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1842,9 +1895,9 @@ modification_date = 2018-05-31 id = 30874d4f-20a1-488f-85ec-5d52ef74e3f9 version = 2 reference = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] -detection_searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shedule Task with HTTP Command Arguments - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule"] +detection_searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1053", "T1053.005", "T1222.001", "T1543.003", "T1546.011", "T1547.001", "T1547.010", "T1564.001", "T1574.009", "T1574.011"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1861,7 +1914,7 @@ version = 2 reference = ["https://attack.mitre.org/tactics/TA0004/"] detection_searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"] mappings = {"cis20": ["CIS 2", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1068", "T1204.002", "T1546.008", "T1546.012"], "nist": ["DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1878,7 +1931,7 @@ version = 3 reference = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"] detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1543.003", "T1569.002", "T1574.011"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update"] data_models = ["Endpoint"] providing_technologies = none diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index abef0ce2d5..c3fd9f16fd 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-04-29T21:10:45 UTC +# On Date: 2021-05-13T21:46:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14,7 +14,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - aws detect sts get session token abuse - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ Herein lies the rub. In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -27,7 +27,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] +searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS). It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -41,7 +41,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", "https://www.cyberark.com/resources/threat-research-blog/the-cloud-shadow-admin-threat-10-permissions-to-protect", "https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS UpdateLoginProfile - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule"] +searches = ["ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS UpdateLoginProfile - Rule"] description = This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation. narrative = Amazon Web Services provides a neat feature called Identity and Access Management (IAM) that enables organizations to manage various AWS services and resources in a secure way. All IAM users have roles, groups and policies associated with them which governs and sets permissions to allow a user to access specific restrictions.\ However, if these IAM policies are misconfigured and have specific combinations of weak permissions; it can allow attackers to escalate their privileges and further compromise the organization. Rhino Security Labs have published comprehensive blogs detailing various AWS Escalation methods. By using this as an inspiration, Splunk’s research team wants to highlight how these attack vectors look in AWS Cloudtrail logs and provide you with detection queries to uncover these potentially malicious events via this Analytic Story. \ @@ -53,7 +53,7 @@ version = 2 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -75,7 +75,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get All AWS Activity From Region - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get All AWS Activity From Region - Response Task"] description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. narrative = Because most enterprise AWS activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary. \ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -87,13 +87,26 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new EC2 instances and increased bandwidth usage. \ Fortunately, you can leverage Amazon Web Services (AWS) CloudTrail--a tool that helps you enable governance, compliance, and risk auditing of your AWS account--to give you increased visibility into your user and resource activity by recording AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred.\ The detection searches in this Analytic Story are designed to help you uncover AWS API activities from users not listed in the identity table, as well as similar activities from disabled accounts. +[analytic_story://Active Directory Password Spraying] +category = Adversary Tactics +last_updated = 2021-04-07 +version = 1 +references = ["https://attack.mitre.org/techniques/T1110/003/", "https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/", "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}] +spec_version = 3 +searches = ["ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Failing To Authenticate From Process - Rule", "ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule"] +description = Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments. +narrative = In a password spraying attack, adversaries leverage one or a small list of commonly used / popular passwords against a large volume of usernames to acquire valid account credentials. Unlike a Brute Force attack that targets a specific user or small group of users with a large number of passwords, password spraying follows the opposite aproach and increases the chances of obtaining valid credentials while avoiding account lockouts. This allows adversaries to remain undetected if the target organization does not have the proper monitoring and detection controls in place.\ +Password Spraying can be leveraged by adversaries across different stages in an attack. It can be used to obtain an iniial access to an environment but can also be used to escalate privileges when access has been already achieved. In some scenarios, this technique capitalizes on a security policy most organizations implement, password rotation. As enterprise users change their passwords, it is possible some pick predictable, seasonal passwords such as `$CompanyNameWinter`, `Summer2021`, etc.\ +Specifically, this Analytic Story is focused on detecting possible Password Spraying attacks against Active Directory environments leveraging Windows Event Logs in the `Account Logon` and `Logon/Logoff` Advanced Audit Policy categories. It presents 9 detection analytics which can aid defenders in identifyng instances where one source user, source host or source process attempts to authenticate against a target or targets using a high, unsual, number of unique users. A user, host or process attempting to authenticate with multiple users is not common behavior for legitimate systems and should be monitored by security teams. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, multi-user systems and missconfigured systems. These should be easily spotted when first implementing the detection and addded to an allow list or lookup table. The presented detections can also be used in Threat Hunting exercises. + [analytic_story://Apache Struts Vulnerability] category = Vulnerability last_updated = 2018-12-06 @@ -101,7 +114,7 @@ version = 1 references = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Investigate Web POSTs From src - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. narrative = In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's 5th largest data breach. The target, credit giant Equifax, told investigators that it had become aware of the vulnerability two months before the attack. \ The exploit involved manipulating the `Content-Type HTTP` header to execute commands embedded in the header.\ @@ -147,7 +160,7 @@ version = 1 references = ["https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule"] +searches = ["ESCU - Detect Baron Samedit CVE-2021-3156 - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule"] description = Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and prior). As this vulnerability was committed to code in July 2011, there will be many distributions affected. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. narrative = A non-privledged user is able to execute the sudoedit command to trigger a buffer overflow. After the successful buffer overflow, they are then able to gain root privileges on the affected host. The conditions needed to be run are a trailing "\" along with shell and edit flags. Monitoring the /var/log directory on Linux hosts using the Splunk Universal Forwarder will allow you to pick up this behavior when using the provided detection. @@ -158,7 +171,7 @@ version = 1 references = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Email Info - Response Task"] +searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. narrative = While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible3phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\ You can use our adaptation of `DNSTwist`, together with the support searches in this Analytic Story, to generate permutations of specified brands and external domains. Splunk can monitor email, DNS requests, and web traffic for these permutations and provide you with early warnings and situational awareness--powerful elements of an effective defense.\ @@ -171,7 +184,7 @@ version = 1 references = ["https://www.hhs.gov/sites/default/files/analyst-note-cl0p-tlp-white.pdf", "https://securityaffairs.co/wordpress/115250/data-breach/qualys-clop-ransomware.html", "https://www.darkreading.com/attacks-breaches/qualys-is-the-latest-victim-of-accellion-data-breach/d/d-id/1340323"] maintainers = [{"company": "Teoderick Contreras, Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Clop Ransomware Known Service Name - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Clop Common Exec Parameter - Rule", "ESCU - Create Service In Suspicious File Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - High File Deletion Frequency - Rule", "ESCU - Resize ShadowStorage volume - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Ransomware Notes bulk creation - Rule"] +searches = ["ESCU - Clop Common Exec Parameter - Rule", "ESCU - Clop Ransomware Known Service Name - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Create Service In Suspicious File Path - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - High File Deletion Frequency - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - Resize ShadowStorage volume - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Clop ransomware, including looking for file writes associated with Clope, encrypting network shares, deleting and resizing shadow volume storage, registry key modification, deleting of security logs, and more. narrative = Clop ransomware campaigns targeting healthcare and other vertical sectors, involve the use of ransomware payloads along with exfiltration of data per HHS bulletin. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data. @@ -182,7 +195,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -196,7 +209,7 @@ version = 1 references = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - O365 Added Service Principal - Rule"] +searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule"] description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements. narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches. @@ -207,7 +220,7 @@ version = 1 references = ["https://www.cobaltstrike.com/", "https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/", "https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/", "https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html", "https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html", "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence", "https://github.com/zer0yu/Awesome-CobaltStrike"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Anomalous usage of 7zip - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule"] +searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule"] description = Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. Many additional variables are provided for in memory operation of the beacon implant. On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike. Not every query may be specific to Cobalt Strike the tool, but the methodologies and techniques used by it.\ Splunk Threat Research reviewed all publicly available instances of Malleabe C2 Profiles and generated a list of the most commonly used spawnto and pipenames.\ @@ -227,7 +240,7 @@ version = 1 references = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Investigate Network Traffic From src ip - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more. narrative = Conventional wisdom holds that Apple's MacOS operating system is significantly less vulnerable to attack than Windows machines. While that point is debatable, it is true that attacks against MacOS systems are much less common. However, this fact does not mean that Macs are impervious to breaches. To the contrary, research has shown that that Mac malware is increasing at an alarming rate. According to AV-test, in 2018, there were 86,865 new MacOS malware variants, up from 27,338 the year before—a 31% increase. In contrast, the independent research firm found that new Windows malware had increased from 65.17M to 76.86M during that same period, less than half the rate of growth. The bottom line is that while the numbers look a lot smaller than Windows, it's definitely time to take Mac security more seriously.\ This Analytic Story addresses the ColdRoot remote access trojan (RAT), which was uploaded to Github in 2016, but was still escaping detection by the first quarter of 2018, when a new, more feature-rich variant was discovered masquerading as an Apple audio driver. Among other capabilities, the Pascal-based ColdRoot can heist passwords from users' keychains and remotely control infected machines without detection. In the initial report of his findings, Patrick Wardle, Chief Research Officer for Digita Security, explained that the new ColdRoot RAT could start and kill processes on the breached system, spawn new remote-desktop sessions, take screen captures and assemble them into a live stream of the victim's desktop, and more.\ @@ -240,7 +253,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\ Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \ @@ -253,7 +266,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\ Because this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists. @@ -277,7 +290,7 @@ version = 1 references = ["https://github.com/splunk/cloud-datamodel-security-research"] maintainers = [{"company": "Rico Valdez, Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - New container uploaded to AWS ECR - Rule", "ESCU - GCP GCR container uploaded - Rule"] +searches = ["ESCU - GCP GCR container uploaded - Rule", "ESCU - New container uploaded to AWS ECR - Rule"] description = Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry. narrative = Container Registrys provide a way for organizations to keep customized images of their development and infrastructure environment in private. However if these repositories are misconfigured or priviledge users credentials are compromise, attackers can potentially upload implanted containers which can be deployed across the organization. These searches allow operator to monitor who, when and what was uploaded to container registry. @@ -288,7 +301,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] +searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -301,7 +314,7 @@ version = 2 references = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Processes launching netsh - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \ There is a wide range of motivations for these state-sponsored hacks, including stealing valuable corporate, military, or diplomatic dataѿall of which could confer advantages in various arenas. They may also target critical infrastructure. \ @@ -327,7 +340,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - DNS Hijack Enrichment - Response Task"] +searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Hijack Enrichment - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\ The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well. \ @@ -339,6 +352,17 @@ On January 22, 2019, the US Department of Homeland Security 2019's Cybersecurity In DNS hijacking, the attacker assumes control over an account or makes use of a DNS service exploit to make changes to DNS records. Once they gain access, attackers can substitute their own MX records, name-server records, and addresses, redirecting emails and traffic through their infrastructure, where they can read, copy, or modify information seen. They can also generate valid encryption certificates to help them avoid browser-certificate checks. In one notable attack on the Internet service provider, GoDaddy, the hackers altered Sender Policy Framework (SPF) records a relatively minor change that did not inflict excessive damage but allowed for more effective spam campaigns.\ The searches in this Analytic Story help you detect and investigate activities that may indicate that DNS hijacking has taken place within your environment. +[analytic_story://DarkSide Ransomware] +category = Malware +last_updated = 2020-06-12 +version = 1 +references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] +spec_version = 3 +searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule"] +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware +narrative = This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload. + [analytic_story://Data Exfiltration] category = Adversary Tactics last_updated = 2020-10-21 @@ -357,7 +381,7 @@ version = 1 references = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point. @@ -379,7 +403,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://github.com/SecuraBV/CVE-2020-1472", "https://www.secura.com/blog/zero-logon", "https://nvd.nist.gov/vuln/detail/CVE-2020-1472"] maintainers = [{"company": "Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier. narrative = This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, using Netlogon Remote Protocol (MS-NRPC). This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and assign themselve high privileges that can lead to domain controller and potentially complete network takeover. The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz tool which has bee updated to carry this attack payload. @@ -390,7 +414,7 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Processes launching netsh - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. narrative = Attackers employ a variety of tactics in order to avoid detection and operate without barriers. This often involves modifying the configuration of security tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes searches that look for activity consistent with attackers attempting to disable various security mechanisms. Such activity may involve monitoring for suspicious registry activity, as this is where much of the configuration for Windows and various other programs reside, or explicitly attempting to shut down security-related services. Other times, attackers attempt various tricks to prevent specific programs from running, such as adding the certificates with which the security tools are signed to a block list (which would prevent them from running). @@ -401,7 +425,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1482/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - DSQuery Domain Discovery - Rule", "ESCU - Windows AdFind Exe - Rule", "ESCU - NLTest Domain Trust Discovery - Rule"] +searches = ["ESCU - DSQuery Domain Discovery - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Windows AdFind Exe - Rule"] description = Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. narrative = Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain. Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting. Domain trusts can be enumerated using the DSEnumerateDomainTrusts() Win32 API call, .NET methods, and LDAP. The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts. @@ -412,7 +436,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists. narrative = Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and deny lists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified. @@ -423,7 +447,7 @@ version = 1 references = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. narrative = The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/). For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \ According to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.\ @@ -447,7 +471,7 @@ version = 1 references = ["https://cloud.google.com/iam/docs/understanding-service-accounts"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Google Cloud Platform (GCP) admins manage access to GCP resources and services across the enterprise using GCP Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage GCP users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as Compute instances, the GCP Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are potentially assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -460,7 +484,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html", "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/", "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/", "https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Any Powershell DownloadString - Rule"] +searches = ["ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule"] description = HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065. narrative = On Tuesday, March 2, 2021, Microsoft released a set of security patches for its mail server, Microsoft Exchange. These patches respond to a group of vulnerabilities known to impact Exchange 2013, 2016, and 2019. It is important to note that an Exchange 2010 security update has also been issued, though the CVEs do not reference that version as being vulnerable.\ While the CVEs do not shed much light on the specifics of the vulnerabilities or exploits, the first vulnerability (CVE-2021-26855) has a remote network attack vector that allows the attacker, a group Microsoft named HAFNIUM, to authenticate as the Exchange server. Three additional vulnerabilities (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) were also identified as part of this activity. When chained together along with CVE-2021-26855 for initial access, the attacker would have complete control over the Exchange server. This includes the ability to run code as SYSTEM and write to any path on the server.\ @@ -473,7 +497,7 @@ version = 2 references = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\ These state-sponsored actors are thought to be responsible for everything from a hack on a South Korean nuclear plant to an attack on Sony in anticipation of its release of the movie "The Interview" at the end of 2014. They're also notorious for cyberespionage. In recent years, the group seems to be focused on financial crimes, such as cryptojacking.\ @@ -498,7 +522,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1105/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Suspicious Curl Network Connection - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Any Powershell DownloadFile - Rule"] +searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Suspicious Curl Network Connection - Rule"] description = Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. narrative = Ingress tool transfer is a Technique under tactic Command and Control. Behaviors will include the use of living off the land binaries to download implants or binaries over alternate communication ports. It is imperative to baseline applications on endpoints to understand what generates network activity, to where, and what is its native behavior. These utilities, when abused, will write files to disk in world writeable paths.\ During triage, review the reputation of the remote public destination IP or domain. Capture any files written to disk and perform analysis. Review other parrallel processes for additional behaviors. @@ -534,7 +558,7 @@ version = 1 references = ["https://github.com/splunk/cloud-datamodel-security-research"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster. @@ -545,7 +569,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects. @@ -556,7 +580,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities @@ -567,7 +591,7 @@ version = 2 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\ Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\ @@ -582,7 +606,7 @@ version = 4 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Any Powershell DownloadFile - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope.\ The following factors may assist you in determining whether the event is malicious: \ @@ -602,7 +626,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1036/003/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule"] +searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule"] description = Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. narrative = Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths.\ The following content is here to assist with binaries within `system32` or `syswow64` being moved to a new location or an adversary bringing a the binary in to execute.\ @@ -626,7 +650,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. narrative = It is critical to identify unauthorized software and processes running on enterprise endpoints and determine whether they are likely to be malicious. This Analytic Story requires the user to populate the Interesting Processes table within Enterprise Security with prohibited processes. An included support search will augment this data, adding information on processes thought to be malicious. This search requires data from endpoint detection-and-response solutions, endpoint data sources (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator has enabled process tracking within the System Event Audit Logs.\ It is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks. @@ -651,7 +675,7 @@ version = 2 references = ["https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/", "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"] maintainers = [{"company": "Michael Haag, Splunk", "email": "-", "name": "Patrick Bareiss"}] spec_version = 3 -searches = ["ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - Windows AdFind Exe - Rule", "ESCU - TOR Traffic - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Anomalous usage of 7zip - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Supernova Webshell - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] +searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - Supernova Webshell - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Windows AdFind Exe - Rule"] description = Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) of the NOBELIUM Group. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. @@ -662,7 +686,7 @@ version = 1 references = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. narrative = It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\ To get started, run the detection search to identify parent processes of `netsh.exe`. @@ -674,7 +698,7 @@ version = 1 references = ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] spec_version = 3 -searches = ["ESCU - O365 Disable MFA - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - High Number of Login Failures from a single source - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule"] +searches = ["ESCU - High Number of Login Failures from a single source - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"] description = This story is focused around detecting Office 365 Attacks. narrative = More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks. @@ -685,7 +709,7 @@ version = 2 references = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. narrative = In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\ Awareness of the Orangeworm group first surfaced in January, 2015. It has conducted targeted attacks against related industries, as well, such as pharmaceuticals and healthcare IT solution providers.\ @@ -699,7 +723,7 @@ version = 1 references = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"] maintainers = [{"company": "iDefense", "email": "-", "name": "iDefense Cyber Espionage Team"}] spec_version = 3 -searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. narrative = This story was created as a joint effort between iDefense and Splunk.\ iDefense analysts have recently discovered a Windows executable file that, upon execution, spoofs a decryption tool and then drops a file that appears to be the custom-built javascript backdoor, "Orz," which is associated with the threat actors known as MUDCARP (as well as "temp.Periscope" and "Leviathan"). The file is executed using Wscript.\ @@ -737,7 +761,7 @@ version = 1 references = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts. @@ -748,7 +772,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task"] +searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -759,7 +783,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"] maintainers = [{"company": "David Dorsey, Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources. @@ -770,7 +794,7 @@ version = 1 references = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get Notable History - Response Task"] description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers. narrative = Networking devices, such as routers and switches, are often overlooked as resources that attackers will leverage to subvert an enterprise. Advanced threats actors have shown a proclivity to target these critical assets as a means to siphon and redirect network traffic, flash backdoored operating systems, and implement cryptographic weakened algorithms to more easily decrypt network traffic.\ This Analytic Story helps you gain a better understanding of how your network devices are interacting with your hosts. By compromising your network devices, attackers can obtain direct access to the company's internal infrastructure— effectively increasing the attack surface and accessing private services/data. @@ -782,7 +806,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more. narrative = Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) on October 28th called “Ransomware Activity Targeting the Healthcare and Public Health Sector.” This alert details TTPs associated with ongoing and possible imminent attacks against the Healthcare sector, and is a joint advisory in coordination with other U.S. Government agencies. The objective of these malicious campaigns is to infiltrate targets in named sectors and to drop ransomware payloads, which will likely cause disruption of service and increase risk of actual harm to the health and safety of patients at hospitals, even with the aggravant of an ongoing COVID-19 pandemic. This document specifically refers to several crimeware exploitation frameworks, emphasizing the use of Ryuk ransomware as payload. The Ryuk ransomware payload is not new. It has been well documented and identified in multiple variants. Payloads need a carrier, and for Ryuk it has often been exploitation frameworks such as Cobalt Strike, or popular crimeware frameworks such as Emotet or Trickbot. @@ -805,7 +829,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - File with Samsam Extension - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task"] +searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\ Although categorized under the heading of ransomware, SamSam campaigns have some importance distinguishing characteristics. Most notable is the fact that conventional ransomware is a numbers game. Perpetrators use a "spray-and-pray" approach with phishing campaigns or other mechanisms, charging a small ransom (typically under $1,000). The goal is to find a large number of victims willing to pay these mini-ransoms, adding up to a lucrative payday. They use relatively simple methods for infecting systems.\ @@ -821,7 +845,7 @@ version = 1 references = ["https://redcanary.com/blog/clipping-silver-sparrows-wings/", "https://www.sentinelone.com/blog/5-things-you-need-to-know-about-silver-sparrow/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious PlistBuddy Usage via OSquery - Rule", "ESCU - Suspicious Curl Network Connection - Rule", "ESCU - Suspicious SQLite3 LSQuarantine Behavior - Rule", "ESCU - Suspicious PlistBuddy Usage - Rule"] +searches = ["ESCU - Suspicious Curl Network Connection - Rule", "ESCU - Suspicious PlistBuddy Usage - Rule", "ESCU - Suspicious PlistBuddy Usage via OSquery - Rule", "ESCU - Suspicious SQLite3 LSQuarantine Behavior - Rule"] description = Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence. narrative = Silver Sparrow works is a dropper and uses typical persistence mechanisms on a Mac. It is cross platform, covering both Intel and Apple M1 architecture. To this date, no implant has been downloaded for malicious purposes. During installation of the update.pkg or updater.pkg file, the malicious software utilizes JavaScript to generate files and scripts on disk for persistence.These files later download a implant from an S3 bucket every hour. This analytic assists with identifying different types of macOS malware families establishing LaunchAgent persistence. Per SentinelOne source, it is predicted that Silver Sparrow is likely selling itself as a mechanism to 3rd party “affiliates” or pay-per-install (PPI) partners, typically seen as commodity adware/malware. Additional indicators and behaviors may be found within the references. @@ -832,7 +856,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}] spec_version = 3 -searches = ["ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Excel Spawning PowerShell - Rule", "ESCU - Detect Outlook exe writing a zip file - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Office Document Creating Schedule Task - Rule"] +searches = ["ESCU - Detect Outlook exe writing a zip file - Rule", "ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ @@ -881,7 +905,7 @@ version = 1 references = ["https://nvd.nist.gov/vuln/detail/CVE-2018-11409", "https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings", "https://www.exploit-db.com/exploits/44865/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Investigate Network Traffic From src ip - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users. narrative = Although there have been no reports of it being exploited, Splunk Enterprise versions through 7.0.1 reportedly have a vulnerability that may expose information through a REST endpoint (read more here: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings). NIST has included it in its vulnerability database (read more here: https://nvd.nist.gov/vuln/detail/CVE-2018-11409). The REST endpoint that exposes system information is also necessary for the proper operation of Splunk clustering and instrumentation. Customers should upgrade to the latest version to reduce the risk of this vulnerability.\ Splunk Enterprise exposes partial information about the host operating system, hardware, and Splunk license. Splunk Enterprise before 6.6.0 exposes this information without authentication. Splunk Enterprise 6.6.0 and later exposes this information only to authenticated Splunk users. Based on the information exposure, Splunk characterizes this issue as a low severity impact.\ @@ -895,7 +919,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] +searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and risk auditing within your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Console, AWS command-line interface, and AWS SDKs and APIs to ensure that your EC2 instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your AWS EC2 instances and helps you respond and investigate those activities. @@ -906,7 +930,7 @@ version = 1 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. @@ -917,7 +941,7 @@ version = 2 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ @@ -930,7 +954,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). narrative = A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \ Amazon's VPC service enables you to launch EC2 instances and leverage other Amazon resources. The traffic that flows in and out of this VPC can be controlled via network access-control rules and security groups. Amazon also has a feature called VPC Flow Logs that enables you to log IP traffic going to and from the network interfaces in your VPC. This data is stored using Amazon CloudWatch Logs.\ @@ -944,7 +968,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\ This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS. @@ -956,7 +980,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities. @@ -967,7 +991,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get Notable History - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -979,7 +1003,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Detect and investigate suspicious activities by users and roles in your cloud environments. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage. @@ -991,7 +1015,7 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation. @@ -1002,7 +1026,7 @@ version = 1 references = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness). However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses. @@ -1013,7 +1037,7 @@ version = 1 references = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Email Info - Response Task"] +searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. narrative = It is a common practice for attackers of all types to leverage targeted spearphishing campaigns and mass mailers to deliver weaponized email messages and attachments. Fortunately, there are a number of ways to monitor email data in Splunk to detect suspicious content.\ Once a phishing message has been detected, the next steps are to answer the following questions: \ @@ -1039,7 +1063,7 @@ version = 2 references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"] maintainers = [{"company": "Michael Haag, Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect mshta renamed - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. narrative = One common adversary tactic is to bypass application control solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code.\ @@ -1062,7 +1086,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task"] +searches = ["ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"] description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors. narrative = Okta is the leading single sign on (SSO) provider, allowing users to authenticate once to Okta, and from there access a variety of web-based applications. These applications are assigned to users and allow administrators to centrally manage which users are allowed to access which applications. It also provides centralized logging to help understand how the applications are used and by whom. \ While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \ @@ -1086,7 +1110,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1218/011/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md", "https://lolbas-project.github.io/lolbas/Binaries/Rundll32"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule"] +searches = ["ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule"] description = Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code. narrative = One common adversary tactic is to bypass application control solutions via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging rundll32.exe to execute malicious code. @@ -1097,7 +1121,7 @@ version = 2 references = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - WMI Permanent Event Subscription - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. \ The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems.\ @@ -1110,7 +1134,7 @@ version = 1 references = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\ The registry is a key component of the Windows operating system. It has a hierarchical database called "registry" that contains settings, options, and values for executables. Once the threat actor gains access to a machine, they can use reg.exe to modify their account to obtain administrator-level privileges, maintain persistence, and move laterally within the environment.\ @@ -1128,6 +1152,17 @@ description = Attackers are using Zoom as an vector to increase privileges on a narrative = Zoom is a leader in modern enterprise video communications and its usage has increased dramatically with a large amount of the population under stay-at-home orders due to the COVID-19 pandemic. With increased usage has come increased scrutiny and several security flaws have been found with this application on both Windows and macOS systems.\ Current detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation. +[analytic_story://Trickbot] +category = Malware +last_updated = 2021-04-20 +version = 1 +references = ["https://en.wikipedia.org/wiki/Trickbot", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"] +maintainers = [{"company": "Teoderick Contreras, Splunk", "email": "-", "name": "Rod Soto"}] +spec_version = 3 +searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Powershell Remote Thread To Known Windows Process - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Trickbot Named Pipe - Rule", "ESCU - Wermgr Process Connecting To IP Check Web Services - Rule", "ESCU - Wermgr Process Create Executable File - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Write Executable in SMB Share - Rule"] +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment. +narrative = trickbot banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS where target security Microsoft Defender to prevent its detection and removal. steal Verizon credentials and targeting banks using its multi component modules that collect and exfiltrate data. + [analytic_story://Trusted Developer Utilities Proxy Execution] category = Adversary Tactics last_updated = 2021-01-12 @@ -1135,7 +1170,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1127/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md", "https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious microsoft workflow compiler usage - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule"] +searches = ["ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious microsoft workflow compiler usage - Rule"] description = Monitor and detect behaviors used by attackers who leverage trusted developer utilities to execute malicious code. narrative = Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.\ The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging microsoft.workflow.compiler.exe to execute malicious code. @@ -1147,7 +1182,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1127/001/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md", "https://github.com/infosecn1nja/MaliciousMacroMSBuild", "https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1", "https://lolbas-project.github.io/lolbas/Binaries/Msbuild/", "https://github.com/MHaggis/CBR-Queries/blob/master/msbuild.md"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule"] +searches = ["ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious msbuild path - Rule"] description = Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code. narrative = Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.\ The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.\ @@ -1183,7 +1218,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\ This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\ @@ -1196,7 +1231,7 @@ version = 1 references = ["https://www.monkey.org/~dugsong/dsniff/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted. narrative = Various legacy protocols operate by default in the clear, without the protections of encryption. This potentially leaks sensitive information that can be exploited by passively sniffing network traffic. Depending on the protocol, this information could be highly sensitive, or could allow for session hijacking. In addition, these protocols send authentication information, which would allow for the harvesting of usernames and passwords that could potentially be used to authenticate and compromise secondary systems. @@ -1207,7 +1242,7 @@ version = 1 references = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jim Apger"}] spec_version = 3 -searches = ["ESCU - Web Fraud - Password Sharing Across Accounts - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Get Web Session Information via session id - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] +searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Web Session Information via session id - Response Task"] description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. narrative = The Federal Bureau of Investigations (FBI) defines Internet fraud as the use of Internet services or software with Internet access to defraud victims or to otherwise take advantage of them. According to the Bureau, Internet crime schemes are used to steal millions of dollars each year from victims and continue to plague the Internet through various methods. The agency includes phishing scams, data breaches, Denial of Service (DOS) attacks, email account compromise, malware, spoofing, and ransomware in this category.\ These crimes are not the fraud itself, but rather the attack techniques commonly employed by fraudsters in their pursuit of data that enables them to commit malicious actssuch as obtaining and using stolen credit cards. They represent a serious problem that is steadily increasing and not likely to go away anytime soon.\ @@ -1223,7 +1258,7 @@ version = 1 references = ["https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", "https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise. The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit. narrative = When a client requests a DNS record for a particular domain, that request gets routed first through the client's locally configured DNS server, then to any DNS server(s) configured as forwarders, and then onto the target domain's own DNS server(s). If a attacker wanted to, they could host a malicious DNS server that responds to the initial request with a specially crafted large response (~65KB). This response would flow through to the client's local DNS server, which if not patched for CVE-2020-1350, would cause the buffer overflow. The detection searches in this Analytic Story use wire data to detect the malicious behavior. Searches for Splunk Stream and Zeek are included. The Splunk Stream search correlates across stream:dns and stream:tcp, while the Zeek search correlates across bro:dns:json and bro:conn:json. These correlations are required to pick up both the DNS record types (SIG and KEY) along with the payload size (>65KB). @@ -1234,7 +1269,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -1245,7 +1280,7 @@ version = 1 references = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques. narrative = Attackers use a variety of techniques to entice users to run malicious code or to persist on an endpoint. One way to accomplish these goals is to leverage file extensions and the mechanism Windows uses to associate files with specific applications. \ Since its earliest days, Windows has used extensions to identify file types. Users have become familiar with these extensions and their application associations. For example, if users see that a file ends in `.doc` or `.docx`, they will assume that it is a Microsoft Word document and expect that double-clicking will open it using `winword.exe`. The user will typically also presume that the `.docx` file is safe. \ @@ -1260,7 +1295,7 @@ version = 2 references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. narrative = Because attackers often modify system logs to cover their tracks and/or to thwart the investigative process, log monitoring is an industry-recognized best practice. While there are legitimate reasons to manipulate system logs, it is still worthwhile to keep track of who manipulated the logs, when they manipulated them, and in what way they manipulated them (determining which accesses, tools, or utilities were employed). Even if no malicious activity is detected, the knowledge of an attempt to manipulate system logs may be indicative of a broader security risk that should be thoroughly investigated.\ The Analytic Story gives users two different ways to detect manipulation of Windows Event Logs and one way to detect deletion of the Update Sequence Number (USN) Change Journal. The story helps determine the history of the host and the users who have accessed it. Finally, the story aides in investigation by retrieving all the information on the process that caused these events (if the process has been identified). @@ -1272,7 +1307,7 @@ version = 2 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Shedule Task with HTTP Command Arguments - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment. @@ -1283,7 +1318,7 @@ version = 2 references = ["https://attack.mitre.org/tactics/TA0004/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. narrative = Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment. @@ -1294,7 +1329,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner. narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection. @@ -1626,6 +1661,16 @@ annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Ob known_false_positives = Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. providing_technologies = [] +[savedsearch://ESCU - Account Discovery With Net App - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002"]} +known_false_positives = admin or power user may used this series of command. +providing_technologies = [] + [savedsearch://ESCU - Amazon EKS Kubernetes Pod scan detection - Rule] type = detection asset_type = Amazon EKS Kubernetes cluster Pod @@ -1746,6 +1791,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_att known_false_positives = It is possible for this search to generate a notable event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary. providing_technologies = [] +[savedsearch://ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} +known_false_positives = Legitimate windows application that are not on the list loading this dll. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - CertUtil Download With URLCache and Split Arguments - Rule] type = detection asset_type = @@ -2152,6 +2207,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"]} known_false_positives = Limited false positives. If there is a true false positive, filter based on command-line or parent process. providing_technologies = [] +[savedsearch://ESCU - Delete ShadowCopy With PowerShell - Rule] +type = detection +asset_type = +confidence = medium +explanation = This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Deleting Shadow Copies - Rule] type = detection asset_type = Endpoint @@ -2582,6 +2647,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = Administrators can leverage PsExec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this event on a machine providing_technologies = [] +[savedsearch://ESCU - Detect RClone Command-Line Usage - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} +known_false_positives = There is potential for false positives as these arguments may be used by other applications. Filter or tune the analytic as needed. +providing_technologies = [] + [savedsearch://ESCU - Detect Rare Executables - Rule] type = detection asset_type = Endpoint @@ -2663,6 +2738,16 @@ annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on O known_false_positives = Limited false positives related to third party software registering .DLL's. providing_technologies = [] +[savedsearch://ESCU - Detect Renamed RClone - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from the legitimate site and executed accordingly. During triage, isolate the endpoint and begin to review parallel processes for additional behavior. At this stage, the adversary may have staged data to be exfiltrated. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} +known_false_positives = False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case. +providing_technologies = [] + [savedsearch://ESCU - Detect Rogue DHCP Server - Rule] type = detection asset_type = Infrastructure @@ -3321,6 +3406,16 @@ annotations = {"cis20": ["CIS 10"], "nist": ["PR.IP"]} known_false_positives = None identified providing_technologies = [] +[savedsearch://ESCU - Extract SAM from Registry - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from a untrusted process or script. Upon execution, a file will be written to disk. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} +known_false_positives = It is possible some agent based products will generate false positives. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - File with Samsam Extension - Rule] type = detection asset_type = Endpoint @@ -3835,6 +3930,45 @@ annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.00 known_false_positives = Normal archive transfer via HTTP protocol may trip this detection. providing_technologies = [] +[savedsearch://ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems. +providing_technologies = [] + +[savedsearch://ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems. +providing_technologies = [] + +[savedsearch://ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies one source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC0000064 stands for `The username you typed does not exist` (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. +providing_technologies = [] + [savedsearch://ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule] type = detection asset_type = Infrastructure @@ -3845,6 +3979,71 @@ annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE. known_false_positives = A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` to raise the threshold or except specific IP adresses from triggering this search. providing_technologies = [] +[savedsearch://ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. +how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. +providing_technologies = [] + +[savedsearch://ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, missconfigured systems and multi-user systems like Citrix farms. +providing_technologies = [] + +[savedsearch://ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. +providing_technologies = [] + +[savedsearch://ESCU - Multiple Users Failing To Authenticate From Process - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies a source process name failing to authenticate with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 generates on domain controllers, member servers, and workstations when an account fails to logon. Logon Type 2 describes an iteractive logon attempt.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed. This could be a domain controller as well as a member server or workstation.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A process failing to authenticate with multiple users is not a common behavior for legitimate user sessions. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. +providing_technologies = [] + +[savedsearch://ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies a source host failing to authenticate against a remote host with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 describes an remote authentication attempt.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server or workstation.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc. +providing_technologies = [] + [savedsearch://ESCU - NLTest Domain Trust Discovery - Rule] type = detection asset_type = Endpoint @@ -4177,6 +4376,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"]} known_false_positives = Limited false positives. It is possible administrators will utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent process or command-line arguments. providing_technologies = [] +[savedsearch://ESCU - Powershell Remote Thread To Known Windows Process - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, Create Remote thread from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of create remote thread may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Process Creating LNK file in Suspicious Location - Rule] type = detection asset_type = Endpoint @@ -4447,6 +4656,26 @@ annotations = {"kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre known_false_positives = Limited to no known false positives. providing_technologies = [] +[savedsearch://ESCU - SLUI RunAs Elevated - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This particular bypass utilizes a registry key/value. Identified by two sources, the registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`. To simulate this behavior, multiple POC are available. The analytic identifies the use of `runas` by `slui.exe`. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +known_false_positives = Limited false positives should be present as this is not commonly used by legitimate applications. +providing_technologies = [] + +[savedsearch://ESCU - SLUI Spawning a Process - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, spawning a child process. This behavior is associated with publicly known UAC bypass. `slui.exe` is commonly associated with software updates and is most often spawned by `svchost.exe`. The `slui.exe` process should not have child processes, and any processes spawning from it will be running with elevated privileges. During triage, review the child process and additional parallel processes. Identify any file modifications that may have lead to the bypass. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +known_false_positives = Certain applications may spawn from `slui.exe` that are legitimate. Filtering will be needed to ensure proper monitoring. +providing_technologies = [] + [savedsearch://ESCU - SMB Traffic Spike - Rule] type = detection asset_type = Endpoint @@ -4500,6 +4729,26 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Inst known_false_positives = Using sc.exe to manipulate Windows services is uncommon. However, there may be legitimate instances of this behavior. It is important to validate and investigate as appropriate. providing_technologies = [] +[savedsearch://ESCU - Schedule Task with HTTP Command Arguments - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' +how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - Schedule Task with Rundll32 Command Trigger - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' +how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Scheduled Task Deleted Or Created via CMD - Rule] type = detection asset_type = Endpoint @@ -4570,16 +4819,6 @@ annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Installation" known_false_positives = Administrators may attempt to change the default execution policy on a system for a variety of reasons. However, setting the policy to "unrestricted" or "bypass" as this search is designed to identify, would be unusual. Hits should be reviewed and investigated as appropriate. providing_technologies = [] -[savedsearch://ESCU - Shedule Task with HTTP Command Arguments - Rule] -type = detection -asset_type = -confidence = medium -explanation = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine.\ The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' -how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. -annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} -known_false_positives = unknown -providing_technologies = [] - [savedsearch://ESCU - Shim Database File Creation - Rule] type = detection asset_type = Endpoint @@ -5008,6 +5247,16 @@ annotations = {"cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and known_false_positives = None at this time providing_technologies = [] +[savedsearch://ESCU - Trickbot Named Pipe - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. . +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - USN Journal Deletion - Rule] type = detection asset_type = Endpoint @@ -5188,6 +5437,36 @@ annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = Some of these processes may be used legitimately on web servers during maintenance or other administrative tasks. providing_technologies = [] +[savedsearch://ESCU - Wermgr Process Connecting To IP Check Web Services - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590.005"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - Wermgr Process Create Executable File - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop executable file. This technique is commonly seen in trickbot malware where it injects it code to this process to execute it malicious behavior like downloading other payload +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of wermgr.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - WinEvent Scheduled Task Created Within Public Path - Rule] type = detection asset_type = @@ -5306,6 +5585,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.00 known_false_positives = There will be limited false positives and it will be different for every environment. Tune by child process or command-line as needed. providing_technologies = [] +[savedsearch://ESCU - Write Executable in SMB Share - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect suspicious dropping or creating an executable file in known sensitive SMB share. This technique is commonly used for lateral movement like how trickbot try to infect other machine in the infected network. This detection catch the access event (FILE WRITE) access to a share. +how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. +annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1021.002"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - aws detect attach to role policy - Rule] type = detection asset_type = AWS Account diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index f72780904b..5d7012e7df 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 27601 +build = 28811 [triggers] reload.analytic_stories = simple @@ -19,7 +19,7 @@ reload.content-version = simple [launcher] author = Splunk -version = 3.20.0 +version = 3.21.0 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 577dc4ec52..db34bd601d 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-04-29T21:10:45 UTC +# On Date: 2021-05-13T21:46:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf index 9880d5c77b..a5773f5ac7 100644 --- a/dist/escu/default/content-version.conf +++ b/dist/escu/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.20.0 +version = 3.21.0 diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index f729159ca5..a3dd4c1b86 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -11,7 +11,7 @@ label = AWS Cryptomining description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior. disabled = 0 -panels = ["panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task"] +panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"] [panel_group://workbench_panel_group_aws_iam_privilege_escalation] label = AWS IAM Privilege Escalation @@ -25,7 +25,7 @@ label = AWS Network ACL Activity description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. disabled = 0 -panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"] +panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] [panel_group://workbench_panel_group_aws_security_hub_alerts] label = AWS Security Hub Alerts @@ -39,21 +39,28 @@ label = AWS Suspicious Provisioning Activities description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. disabled = 0 -panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_get_all_aws_activity_from_region___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_country___response_task", "panel://workbench_panel_get_all_aws_activity_from_city___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task"] +panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_city___response_task", "panel://workbench_panel_get_all_aws_activity_from_country___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_all_aws_activity_from_region___response_task"] [panel_group://workbench_panel_group_aws_user_monitoring] label = AWS User Monitoring description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. disabled = 0 -panels = ["panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task"] + +[panel_group://workbench_panel_group_active_directory_password_spraying] +label = Active Directory Password Spraying +description = Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_apache_struts_vulnerability] label = Apache Struts Vulnerability description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. disabled = 0 -panels = ["panel://workbench_panel_investigate_web_posts_from_src___response_task", "panel://workbench_panel_investigate_suspicious_strings_in_http_header___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_suspicious_strings_in_http_header___response_task", "panel://workbench_panel_investigate_web_posts_from_src___response_task"] [panel_group://workbench_panel_group_asset_tracking] label = Asset Tracking @@ -81,7 +88,7 @@ label = Brand Monitoring description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. disabled = 0 -panels = ["panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_email_info___response_task"] +panels = ["panel://workbench_panel_get_email_info___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] [panel_group://workbench_panel_group_clop_ransomware] label = Clop Ransomware @@ -95,7 +102,7 @@ label = Cloud Cryptomining description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. disabled = 0 -panels = ["panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task"] +panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"] [panel_group://workbench_panel_group_cloud_federated_credential_abuse] label = Cloud Federated Credential Abuse @@ -116,21 +123,21 @@ label = ColdRoot MacOS RAT description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more. disabled = 0 -panels = ["panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task"] [panel_group://workbench_panel_group_collection_and_staging] label = Collection and Staging description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_command_and_control] label = Command and Control description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. disabled = 0 -panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"] +panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] [panel_group://workbench_panel_group_common_phishing_frameworks] label = Common Phishing Frameworks @@ -151,14 +158,14 @@ label = Credential Dumping description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. disabled = 0 -panels = ["panel://workbench_panel_investigate_pass_the_ticket_attempts___response_task", "panel://workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task", "panel://workbench_panel_investigate_pass_the_hash_attempts___response_task", "panel://workbench_panel_investigate_previous_unseen_user___response_task"] +panels = ["panel://workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task", "panel://workbench_panel_investigate_pass_the_hash_attempts___response_task", "panel://workbench_panel_investigate_pass_the_ticket_attempts___response_task", "panel://workbench_panel_investigate_previous_unseen_user___response_task"] [panel_group://workbench_panel_group_dhs_report_ta18_074a] label = DHS Report TA18-074A description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. disabled = 0 -panels = ["panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_file_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_file_activity___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] [panel_group://workbench_panel_group_dns_amplification_attacks] label = DNS Amplification Attacks @@ -172,7 +179,14 @@ label = DNS Hijacking description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. disabled = 0 -panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_dns_hijack_enrichment___response_task"] +panels = ["panel://workbench_panel_dns_hijack_enrichment___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"] + +[panel_group://workbench_panel_group_darkside_ransomware] +label = DarkSide Ransomware +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_data_exfiltration] label = Data Exfiltration @@ -186,7 +200,7 @@ label = Data Protection description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. disabled = 0 -panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"] +panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] [panel_group://workbench_panel_group_deobfuscate_decode_files_or_information] label = Deobfuscate-Decode Files or Information @@ -207,7 +221,7 @@ label = Disabling Security Tools description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_domain_trust_discovery] label = Domain Trust Discovery @@ -221,14 +235,14 @@ label = Dynamic DNS description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists. disabled = 0 -panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] [panel_group://workbench_panel_group_emotet_malware__dhs_report_ta18_201a_] label = Emotet Malware DHS Report TA18-201A description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. disabled = 0 -panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task"] +panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] [panel_group://workbench_panel_group_f5_tmui_rce_cve_2020_5902] label = F5 TMUI RCE CVE-2020-5902 @@ -256,7 +270,7 @@ label = Hidden Cobra Malware description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. disabled = 0 -panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"] +panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task"] [panel_group://workbench_panel_group_host_redirection] label = Host Redirection @@ -284,7 +298,7 @@ label = Kubernetes Scanning Activity description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names. disabled = 0 -panels = ["panel://workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task", "panel://workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task", "panel://workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_kubernetes_sensitive_object_access_activity] label = Kubernetes Sensitive Object Access Activity @@ -305,14 +319,14 @@ label = Lateral Movement description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. disabled = 0 -panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task"] +panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task"] [panel_group://workbench_panel_group_malicious_powershell] label = Malicious PowerShell description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. disabled = 0 -panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_masquerading___rename_system_utilities] label = Masquerading - Rename System Utilities @@ -333,7 +347,7 @@ label = Monitor for Unauthorized Software description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_monitor_for_updates] label = Monitor for Updates @@ -354,7 +368,7 @@ label = Netsh Abuse description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_office_365_detections] label = Office 365 Detections @@ -368,28 +382,28 @@ label = Orangeworm Attack Group description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. disabled = 0 -panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns] label = Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. disabled = 0 -panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_prohibited_traffic_allowed_or_protocol_mismatch] label = Prohibited Traffic Allowed or Protocol Mismatch description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. disabled = 0 -panels = ["panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"] +panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] [panel_group://workbench_panel_group_ransomware] label = Ransomware description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. disabled = 0 -panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_backup_logs_for_endpoint___response_task"] +panels = ["panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task"] [panel_group://workbench_panel_group_ransomware_cloud] label = Ransomware Cloud @@ -424,7 +438,7 @@ label = SamSam Ransomware description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. disabled = 0 -panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_backup_logs_for_endpoint___response_task"] +panels = ["panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task"] [panel_group://workbench_panel_group_silver_sparrow] label = Silver Sparrow @@ -459,14 +473,14 @@ label = Splunk Enterprise Vulnerability CVE-2018-11409 description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users. disabled = 0 -panels = ["panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task"] [panel_group://workbench_panel_group_suspicious_aws_ec2_activities] label = Suspicious AWS EC2 Activities description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it. disabled = 0 -panels = ["panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task"] +panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"] [panel_group://workbench_panel_group_suspicious_aws_login_activities] label = Suspicious AWS Login Activities @@ -480,21 +494,21 @@ label = Suspicious AWS S3 Activities description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. disabled = 0 -panels = ["panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"] +panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"] [panel_group://workbench_panel_group_suspicious_aws_traffic] label = Suspicious AWS Traffic description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). disabled = 0 -panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"] +panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] [panel_group://workbench_panel_group_suspicious_cloud_authentication_activities] label = Suspicious Cloud Authentication Activities description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. disabled = 0 -panels = ["panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task"] [panel_group://workbench_panel_group_suspicious_cloud_instance_activities] label = Suspicious Cloud Instance Activities @@ -522,21 +536,21 @@ label = Suspicious Command-Line Executions description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_suspicious_dns_traffic] label = Suspicious DNS Traffic description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. disabled = 0 -panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"] +panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] [panel_group://workbench_panel_group_suspicious_emails] label = Suspicious Emails description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. disabled = 0 -panels = ["panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_email_info___response_task"] +panels = ["panel://workbench_panel_get_email_info___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_suspicious_gcp_storage_activities] label = Suspicious GCP Storage Activities @@ -550,14 +564,14 @@ label = Suspicious MSHTA Activity description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_suspicious_okta_activity] label = Suspicious Okta Activity description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors. disabled = 0 -panels = ["panel://workbench_panel_investigate_okta_activity_by_app___response_task", "panel://workbench_panel_investigate_user_activities_in_okta___response_task", "panel://workbench_panel_investigate_okta_activity_by_ip_address___response_task"] +panels = ["panel://workbench_panel_investigate_okta_activity_by_ip_address___response_task", "panel://workbench_panel_investigate_okta_activity_by_app___response_task", "panel://workbench_panel_investigate_user_activities_in_okta___response_task"] [panel_group://workbench_panel_group_suspicious_regsvr32_activity] label = Suspicious Regsvr32 Activity @@ -578,14 +592,14 @@ label = Suspicious WMI Use description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. disabled = 0 -panels = ["panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task"] [panel_group://workbench_panel_group_suspicious_windows_registry_activities] label = Suspicious Windows Registry Activities description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_suspicious_zoom_child_processes] label = Suspicious Zoom Child Processes @@ -594,6 +608,13 @@ disabled = 0 panels = ["panel://workbench_panel_get_process_file_activity___response_task"] +[panel_group://workbench_panel_group_trickbot] +label = Trickbot +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] + [panel_group://workbench_panel_group_trusted_developer_utilities_proxy_execution] label = Trusted Developer Utilities Proxy Execution description = Monitor and detect behaviors used by attackers who leverage trusted developer utilities to execute malicious code. @@ -620,21 +641,21 @@ label = Unusual Processes description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_use_of_cleartext_protocols] label = Use of Cleartext Protocols description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted. disabled = 0 -panels = ["panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] [panel_group://workbench_panel_group_web_fraud_detection] label = Web Fraud Detection description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. disabled = 0 -panels = ["panel://workbench_panel_get_web_session_information_via_session_id___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task"] +panels = ["panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_web_session_information_via_session_id___response_task"] [panel_group://workbench_panel_group_windows_dns_sigred_cve_2020_1350] label = Windows DNS SIGRed CVE-2020-1350 @@ -648,42 +669,42 @@ label = Windows Defense Evasion Tactics description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_windows_file_extension_and_association_abuse] label = Windows File Extension and Association Abuse description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_windows_log_manipulation] label = Windows Log Manipulation description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_windows_persistence_techniques] label = Windows Persistence Techniques description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_windows_privilege_escalation] label = Windows Privilege Escalation description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] [panel_group://workbench_panel_group_windows_service_abuse] label = Windows Service Abuse description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 86e6826e33..ea72020236 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-04-29T21:10:45 UTC +# On Date: 2021-05-13T21:46:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -142,6 +142,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet definition = eventtype="osquery-process" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +[powershell] +definition = sourcetype=wineventlog OR source=WinEventLog:Microsoft-Windows-PowerShell/Operational +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + [previously_seen_cloud_api_calls_per_user_role_forget_window] definition = "-90d@d" description = Use this macro to determine how long to keep track of cloud api calls per user role @@ -419,6 +423,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[account_discovery_with_net_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [amazon_eks_kubernetes_pod_scan_detection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -467,6 +475,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[cmlua_or_cmstplua_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [certutil_download_with_urlcache_and_split_arguments_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -619,6 +631,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[delete_shadowcopy_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [deleting_shadow_copies_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -783,6 +799,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[detect_rclone_command_line_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [detect_rare_executables_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -815,6 +835,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[detect_renamed_rclone_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [detect_rogue_dhcp_server_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1071,6 +1095,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[extract_sam_from_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [file_with_samsam_extension_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1275,10 +1303,42 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. +[multiple_users_attempting_to_authenticate_using_explicit_credentials_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_users_failing_to_authenticate_from_host_using_kerberos_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_users_failing_to_authenticate_from_host_using_ntlm_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_users_failing_to_authenticate_from_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_users_remotely_failing_to_authenticate_from_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [nltest_domain_trust_discovery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1411,6 +1471,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[powershell_remote_thread_to_known_windows_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [process_creating_lnk_file_in_suspicious_location_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1519,6 +1583,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[slui_runas_elevated_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[slui_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [smb_traffic_spike_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1539,6 +1611,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[schedule_task_with_http_command_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[schedule_task_with_rundll32_command_trigger_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [scheduled_task_deleted_or_created_via_cmd_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1567,10 +1647,6 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[shedule_task_with_http_command_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - [shim_database_file_creation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1735,6 +1811,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[trickbot_named_pipe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [usn_journal_deletion_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1807,6 +1887,18 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[wermgr_process_connecting_to_ip_check_web_services_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wermgr_process_create_executable_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wermgr_process_spawned_cmd_or_powershell_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [winevent_scheduled_task_created_within_public_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1851,6 +1943,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[write_executable_in_smb_share_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [aws_detect_attach_to_role_policy_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 5f1f7a4a56..5ed2eada76 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-04-29T21:10:45 UTC +# On Date: 2021-05-13T21:46:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -1250,6 +1250,46 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter` +[ESCU - Account Discovery With Net App - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +action.escu.known_false_positives = admin or power user may used this series of command. +action.escu.creation_date = 2021-05-03 +action.escu.modification_date = 2021-05-03 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Account Discovery With Net App - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Trickbot"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Account Discovery With Net App - Rule +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. +action.notable.param.rule_title = Account Discovery With Net App +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND (Processes.process="*user*" OR Processes.process="*config*" OR Processes.process="*view /all*") by Processes.process_name Processes.dest Processes.user Processes.parent_process_name | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter` + [ESCU - Amazon EKS Kubernetes Pod scan detection - Rule] action.escu = 0 action.escu.enabled = 1 @@ -1504,13 +1544,13 @@ action.escu.full_search_name = ESCU - Attempt To Stop Security Service - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Disabling Security Tools"] +action.escu.analytic_story = ["Disabling Security Tools", "Trickbot"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attempt To Stop Security Service - Rule -action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools", "Trickbot"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -1544,13 +1584,13 @@ action.escu.full_search_name = ESCU - Attempted Credential Dump From Registry vi action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Credential Dumping"] +action.escu.analytic_story = ["Credential Dumping", "DarkSide Ransomware"] cron_schedule = 0 * * * * dispatch.earliest_time = -40m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attempted Credential Dump From Registry via Reg exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -1560,7 +1600,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter` [ESCU - BCDEdit Failure Recovery Modification - Rule] action.escu = 0 @@ -1658,13 +1698,13 @@ action.escu.full_search_name = ESCU - BITSAdmin Download File - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Ingress Tool Transfer", "BITS Jobs"] +action.escu.analytic_story = ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - BITSAdmin Download File - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "BITS Jobs"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197", "T1105"]} +action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197", "T1105"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -1722,6 +1762,45 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name values(Filesystem.user) as user from datamodel=Endpoint.Filesystem by Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex field=file_name "(?\.[^\.]+)$" | search file_path=*system32* AND file_extension=.bat | `batch_file_write_to_system32_filter` +[ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} +action.escu.data_models = [] +action.escu.eli5 = This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = Legitimate windows application that are not on the list loading this dll. Filter as needed. +action.escu.creation_date = 2021-05-13 +action.escu.modification_date = 2021-05-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. +action.notable.param.rule_title = CMLUA Or CMSTPLUA UAC Bypass +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmlua_or_cmstplua_uac_bypass_filter` + [ESCU - CertUtil Download With URLCache and Split Arguments - Rule] action.escu = 0 action.escu.enabled = 1 @@ -1738,13 +1817,13 @@ action.escu.full_search_name = ESCU - CertUtil Download With URLCache and Split action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Ingress Tool Transfer"] +action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - CertUtil Download With URLCache and Split Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]} +action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -1778,13 +1857,13 @@ action.escu.full_search_name = ESCU - CertUtil Download With VerifyCtl and Split action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Ingress Tool Transfer"] +action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]} +action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2495,13 +2574,13 @@ action.escu.full_search_name = ESCU - Cobalt Strike Named Pipes - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Cobalt Strike"] +action.escu.analytic_story = ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Cobalt Strike Named Pipes - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1055"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1055"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -2518,7 +2597,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*, \\srvsvc_*, \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, \\winsock*) | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, process_id process_path, PipeName | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cobalt_strike_named_pipes_filter` +search = `sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*, \\srvsvc_*, \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, \\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, process_id process_path, PipeName | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cobalt_strike_named_pipes_filter` [ESCU - Common Ransomware Extensions - Rule] action.escu = 0 @@ -3232,6 +3311,45 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dsquery.exe Processes.process=*trustedDomain* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dsquery_domain_discovery_filter` +[ESCU - Delete ShadowCopy With PowerShell - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +action.escu.data_models = [] +action.escu.eli5 = This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-05-12 +action.escu.modification_date = 2021-05-12 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Delete ShadowCopy With PowerShell - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["DarkSide Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Delete ShadowCopy With PowerShell - Rule +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. +action.notable.param.rule_title = Delete ShadowCopy With PowerShell +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `delete_shadowcopy_with_powershell_filter` + [ESCU - Deleting Shadow Copies - Rule] action.escu = 0 action.escu.enabled = 1 @@ -4381,13 +4499,13 @@ action.escu.full_search_name = ESCU - Detect Mimikatz Using Loaded Images - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse"] +action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"] cron_schedule = 0 * * * * dispatch.earliest_time = -40m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Mimikatz Using Loaded Images - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -4850,13 +4968,13 @@ action.escu.full_search_name = ESCU - Detect PsExec With accepteula Flag - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group"] +action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect PsExec With accepteula Flag - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -4874,6 +4992,46 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*psexec* Processes.process=*accepteula* by Processes.process_name Processes.dest Processes.parent_process_name | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter` +[ESCU - Detect RClone Command-Line Usage - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. +action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = There is potential for false positives as these arguments may be used by other applications. Filter or tune the analytic as needed. +action.escu.creation_date = 2021-05-13 +action.escu.modification_date = 2021-05-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect RClone Command-Line Usage - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect RClone Command-Line Usage - Rule +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. +action.notable.param.rule_title = Detect RClone Command-Line Usage +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*copy*", "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter` + [ESCU - Detect Rare Executables - Rule] action.escu = 0 action.escu.enabled = 1 @@ -5197,6 +5355,46 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=regsvr32.exe OR Processes.process_name!=regsvr32.exe) Processes.process=*scrobj* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_regsvr32_application_control_bypass_filter` +[ESCU - Detect Renamed RClone - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from the legitimate site and executed accordingly. During triage, isolate the endpoint and begin to review parallel processes for additional behavior. At this stage, the adversary may have staged data to be exfiltrated. +action.escu.mappings = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from the legitimate site and executed accordingly. During triage, isolate the endpoint and begin to review parallel processes for additional behavior. At this stage, the adversary may have staged data to be exfiltrated. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case. +action.escu.creation_date = 2021-05-13 +action.escu.modification_date = 2021-05-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Renamed RClone - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Renamed RClone - Rule +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from the legitimate site and executed accordingly. During triage, isolate the endpoint and begin to review parallel processes for additional behavior. At this stage, the adversary may have staged data to be exfiltrated. +action.notable.param.rule_title = Detect Renamed RClone +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventID=1 OriginalFileName=rclone.exe NOT process_name=rclone.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_rclone_filter` + [ESCU - Detect Rogue DHCP Server - Rule] action.escu = 0 action.escu.enabled = 1 @@ -7789,6 +7987,40 @@ realtime_schedule = 0 is_visible = false search = `netbackup` MESSAGE="Disk/Partition backup completed successfully." | stats latest(_time) as latestTime by COMPUTERNAME | `security_content_ctime(latestTime)` | rename COMPUTERNAME as dest | eval isOutlier=if(latestTime <= relative_time(now(), "-7d@d"), 1, 0) | search isOutlier=1 | table latestTime, dest | `extended_period_without_successful_netbackup_backups_filter` +[ESCU - Extract SAM from Registry - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from a untrusted process or script. Upon execution, a file will be written to disk. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from a untrusted process or script. Upon execution, a file will be written to disk. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = It is possible some agent based products will generate false positives. Filter as needed. +action.escu.creation_date = 2021-05-12 +action.escu.modification_date = 2021-05-12 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Extract SAM from Registry - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["DarkSide Ransomware", "Credential Dumping"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -40m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Extract SAM from Registry - Rule +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Credential Dumping"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*sam* OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extract_sam_from_registry_filter` + [ESCU - File with Samsam Extension - Rule] action.escu = 0 action.escu.enabled = 1 @@ -9816,6 +10048,150 @@ realtime_schedule = 0 is_visible = false search = `stream_http` http_method=POST |eval archive_hdr1=substr(form_data,1,2) | eval archive_hdr2 = substr(form_data,1,4) |stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent uri_path url bytes_in bytes_out archive_hdr1 archive_hdr2 |where count >20 AND (archive_hdr1 = "7z" OR archive_hdr1 = "PK" OR archive_hdr2="Rar!") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `multiple_archive_files_http_post_traffic_filter` +[ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +action.escu.known_false_positives = A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems. +action.escu.creation_date = 2021-04-14 +action.escu.modification_date = 2021-04-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Password Spraying"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +action.notable.param.rule_title = Multiple Disabled Users Failing To Authenticate From Host Using Kerberos +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter` + +[ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +action.escu.known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems. +action.escu.creation_date = 2021-04-14 +action.escu.modification_date = 2021-04-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Password Spraying"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +action.notable.param.rule_title = Multiple Invalid Users Failing To Authenticate From Host Using Kerberos +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter` + +[ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies one source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC0000064 stands for `The username you typed does not exist` (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies one source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC0000064 stands for `The username you typed does not exist` (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled. +action.escu.known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. +action.escu.creation_date = 2021-04-15 +action.escu.modification_date = 2021-04-15 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Password Spraying"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC0000064 stands for `The username you typed does not exist` (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. +action.notable.param.rule_title = Multiple Invalid Users Failing To Authenticate From Host Using NTLM +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter` + [ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule] action.escu = 0 action.escu.enabled = 1 @@ -9855,6 +10231,246 @@ realtime_schedule = 0 is_visible = false search = `okta` outcome.reason=INVALID_CREDENTIALS | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users values(user) as users by src_ip, displayMessage, outcome.reason, country, state, city | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search distinct_users > 5| `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` +[ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. +action.escu.known_false_positives = A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. +action.escu.creation_date = 2021-04-13 +action.escu.modification_date = 2021-04-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Password Spraying"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. +action.notable.param.rule_title = Multiple Users Attempting To Authenticate Using Explicit Credentials +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` + +[ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +action.escu.known_false_positives = A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, missconfigured systems and multi-user systems like Citrix farms. +action.escu.creation_date = 2021-04-08 +action.escu.modification_date = 2021-04-08 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Password Spraying"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +action.notable.param.rule_title = Multiple Users Failing To Authenticate From Host Using Kerberos +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$" | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter` + +[ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled. +action.escu.known_false_positives = A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. +action.escu.creation_date = 2021-04-13 +action.escu.modification_date = 2021-04-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Password Spraying"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. +action.notable.param.rule_title = Multiple Users Failing To Authenticate From Host Using NTLM +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter` + +[ESCU - Multiple Users Failing To Authenticate From Process - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a source process name failing to authenticate with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 generates on domain controllers, member servers, and workstations when an account fails to logon. Logon Type 2 describes an iteractive logon attempt.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed. This could be a domain controller as well as a member server or workstation.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies a source process name failing to authenticate with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 generates on domain controllers, member servers, and workstations when an account fails to logon. Logon Type 2 describes an iteractive logon attempt.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed. This could be a domain controller as well as a member server or workstation.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. +action.escu.known_false_positives = A process failing to authenticate with multiple users is not a common behavior for legitimate user sessions. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. +action.escu.creation_date = 2021-04-13 +action.escu.modification_date = 2021-04-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Multiple Users Failing To Authenticate From Process - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Password Spraying"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Process - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic identifies a source process name failing to authenticate with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 generates on domain controllers, member servers, and workstations when an account fails to logon. Logon Type 2 describes an iteractive logon attempt.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed. This could be a domain controller as well as a member server or workstation.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. +action.notable.param.rule_title = Multiple Users Failing To Authenticate From Process +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-" | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name) as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Caller_Process_Name, Source_Account, ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_process_filter` + +[ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a source host failing to authenticate against a remote host with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 describes an remote authentication attempt.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server or workstation.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies a source host failing to authenticate against a remote host with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 describes an remote authentication attempt.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server or workstation.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. +action.escu.known_false_positives = A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc. +action.escu.creation_date = 2021-04-13 +action.escu.modification_date = 2021-04-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Password Spraying"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic identifies a source host failing to authenticate against a remote host with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 describes an remote authentication attempt.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server or workstation.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. +action.notable.param.rule_title = Multiple Users Remotely Failing To Authenticate From Host +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-" | bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` + [ESCU - NLTest Domain Trust Discovery - Rule] action.escu = 0 action.escu.enabled = 1 @@ -10498,13 +11114,13 @@ action.escu.full_search_name = ESCU - Office Application Spawn rundll32 process action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Spearphishing Attachments"] +action.escu.analytic_story = ["Spearphishing Attachments", "Trickbot"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Application Spawn rundll32 process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -10520,7 +11136,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name = "wordpad.exe") Processes.process_name=rundll32.exe by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `office_application_spawn_rundll32_process_filter` +search = | tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") Processes.process_name=rundll32.exe by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `office_application_spawn_rundll32_process_filter` [ESCU - Office Document Creating Schedule Task - Rule] action.escu = 0 @@ -10559,7 +11175,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "wordpad.exe") ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter` +search = `sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter` [ESCU - Office Document Executing Macro Code - Rule] action.escu = 0 @@ -10577,13 +11193,13 @@ action.escu.full_search_name = ESCU - Office Document Executing Macro Code - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Spearphishing Attachments"] +action.escu.analytic_story = ["Spearphishing Attachments", "Trickbot"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Document Executing Macro Code - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this detection was designed to identifies suspicious office documents that using macro code. Macro code is known to be one of the prevalent weaponization or attack vector of threat actor. This malicious macro code is embed to a office document as an attachment that may execute malicious payload, download malware payload or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. @@ -10598,7 +11214,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "wordpad.exe") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter` +search = `sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter` [ESCU - Office Document Spawned Child Process To Download - Rule] action.escu = 0 @@ -10637,7 +11253,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", "excel.exe", "visio.exe", "wordpad.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter` +search = `sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", "excel.exe", "visio.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter` [ESCU - Office Product Spawning BITSAdmin - Rule] action.escu = 0 @@ -11154,6 +11770,45 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe Processes.process=*start-bitstransfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_start_bitstransfer_filter` +[ESCU - Powershell Remote Thread To Known Windows Process - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +action.escu.data_models = [] +action.escu.eli5 = this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, Create Remote thread from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of create remote thread may be used. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-04-19 +action.escu.modification_date = 2021-04-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Powershell Remote Thread To Known Windows Process - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Trickbot"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Powershell Remote Thread To Known Windows Process - Rule +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload +action.notable.param.rule_title = Powershell Remote Thread To Known Windows Process +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe") TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") | stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remote_thread_to_known_windows_process_filter` + [ESCU - Process Creating LNK file in Suspicious Location - Rule] action.escu = 0 action.escu.enabled = 1 @@ -11567,13 +12222,13 @@ action.escu.full_search_name = ESCU - Ransomware Notes bulk creation - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Clop Ransomware"] +action.escu.analytic_story = ["Clop Ransomware", "DarkSide Ransomware"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Ransomware Notes bulk creation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1486"]} +action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware", "DarkSide Ransomware"], "kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1486"]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your lookup table list for monitoring. @@ -11588,7 +12243,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer Image file_name | where unique_readme_path_count >= 50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter` +search = `sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer Image file_name | where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter` [ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule] action.escu = 0 @@ -12229,6 +12884,86 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*8 LAN*" OR Processes.process="*9 REP*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `ryuk_wake_on_lan_command_filter` +[ESCU - SLUI RunAs Elevated - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This particular bypass utilizes a registry key/value. Identified by two sources, the registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`. To simulate this behavior, multiple POC are available. The analytic identifies the use of `runas` by `slui.exe`. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This particular bypass utilizes a registry key/value. Identified by two sources, the registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`. To simulate this behavior, multiple POC are available. The analytic identifies the use of `runas` by `slui.exe`. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Limited false positives should be present as this is not commonly used by legitimate applications. +action.escu.creation_date = 2021-05-13 +action.escu.modification_date = 2021-05-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - SLUI RunAs Elevated - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["DarkSide Ransomware", "Windows Defense Evasion Tactics"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - SLUI RunAs Elevated - Rule +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This particular bypass utilizes a registry key/value. Identified by two sources, the registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`. To simulate this behavior, multiple POC are available. The analytic identifies the use of `runas` by `slui.exe`. +action.notable.param.rule_title = SLUI RunAs Elevated +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=slui.exe (Processes.process=*-verb* Processes.process=*runas*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `slui_runas_elevated_filter` + +[ESCU - SLUI Spawning a Process - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, spawning a child process. This behavior is associated with publicly known UAC bypass. `slui.exe` is commonly associated with software updates and is most often spawned by `svchost.exe`. The `slui.exe` process should not have child processes, and any processes spawning from it will be running with elevated privileges. During triage, review the child process and additional parallel processes. Identify any file modifications that may have lead to the bypass. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, spawning a child process. This behavior is associated with publicly known UAC bypass. `slui.exe` is commonly associated with software updates and is most often spawned by `svchost.exe`. The `slui.exe` process should not have child processes, and any processes spawning from it will be running with elevated privileges. During triage, review the child process and additional parallel processes. Identify any file modifications that may have lead to the bypass. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Certain applications may spawn from `slui.exe` that are legitimate. Filtering will be needed to ensure proper monitoring. +action.escu.creation_date = 2021-05-13 +action.escu.modification_date = 2021-05-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - SLUI Spawning a Process - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["DarkSide Ransomware", "Windows Defense Evasion Tactics"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - SLUI Spawning a Process - Rule +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, spawning a child process. This behavior is associated with publicly known UAC bypass. `slui.exe` is commonly associated with software updates and is most often spawned by `svchost.exe`. The `slui.exe` process should not have child processes, and any processes spawning from it will be running with elevated privileges. During triage, review the child process and additional parallel processes. Identify any file modifications that may have lead to the bypass. +action.notable.param.rule_title = SLUI Spawning a Process +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=slui.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `slui_spawning_a_process_filter` + [ESCU - SMB Traffic Spike - Rule] action.escu = 0 action.escu.enabled = 1 @@ -12432,6 +13167,84 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sc.exe (Processes.process="* create *" OR Processes.process="* config *") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sc_exe_manipulating_windows_services_filter` +[ESCU - Schedule Task with HTTP Command Arguments - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} +action.escu.data_models = [] +action.escu.eli5 = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-04-19 +action.escu.modification_date = 2021-04-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Schedule Task with HTTP Command Arguments - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Persistence Techniques"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Schedule Task with HTTP Command Arguments - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' +action.notable.param.rule_title = Schedule Task with HTTP Command Arguments +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN ("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schedule_task_with_http_command_arguments_filter` + +[ESCU - Schedule Task with Rundll32 Command Trigger - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} +action.escu.data_models = [] +action.escu.eli5 = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-04-19 +action.escu.modification_date = 2021-04-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Schedule Task with Rundll32 Command Trigger - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Persistence Techniques", "Trickbot"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Schedule Task with Rundll32 Command Trigger - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' +action.notable.param.rule_title = Schedule Task with Rundll32 Command Trigger +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN ("*rundll32*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `schedule_task_with_rundll32_command_trigger_filter` + [ESCU - Scheduled Task Deleted Or Created via CMD - Rule] action.escu = 0 action.escu.enabled = 1 @@ -12706,45 +13519,6 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter` -[ESCU - Shedule Task with HTTP Command Arguments - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine.\ The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} -action.escu.data_models = [] -action.escu.eli5 = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine.\ The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. -action.escu.known_false_positives = unknown -action.escu.creation_date = 2021-04-19 -action.escu.modification_date = 2021-04-19 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Shedule Task with HTTP Command Arguments - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Windows Persistence Techniques"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Shedule Task with HTTP Command Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} -schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine.\ The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' -action.notable.param.rule_title = Shedule Task with HTTP Command Arguments -action.notable.param.security_domain = endpoint -action.notable.param.severity = high -alert.digest_mode = 1 -disabled = true -enableSched = 1 -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN ("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shedule_task_with_http_command_arguments_filter` - [ESCU - Shim Database File Creation - Rule] action.escu = 0 action.escu.enabled = 1 @@ -13762,13 +14536,13 @@ action.escu.full_search_name = ESCU - Suspicious Rundll32 StartW - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike"] +action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 StartW - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -14430,6 +15204,45 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.app=tor AND All_Traffic.action=allowed by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `tor_traffic_filter` +[ESCU - Trickbot Named Pipe - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +action.escu.data_models = [] +action.escu.eli5 = this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. . +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-04-26 +action.escu.modification_date = 2021-04-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Trickbot Named Pipe - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Trickbot"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Trickbot Named Pipe - Rule +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. +action.notable.param.rule_title = Trickbot Named Pipe +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" | stats min(_time) as firstTime max(_time) as lastTime count by Computer user_id EventCode PipeName signature Image process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `trickbot_named_pipe_filter` + [ESCU - USN Journal Deletion - Rule] action.escu = 0 action.escu.enabled = 1 @@ -15140,6 +15953,125 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.dest_category="web_server" AND (Processes.process="*whoami*" OR Processes.process="*ping*" OR Processes.process="*iptables*" OR Processes.process="*wget*" OR Processes.process="*service*" OR Processes.process="*curl*") by Processes.process Processes.process_name, Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `web_servers_executing_suspicious_processes_filter` +[ESCU - Wermgr Process Connecting To IP Check Web Services - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590.005"]} +action.escu.data_models = [] +action.escu.eli5 = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-04-19 +action.escu.modification_date = 2021-04-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Wermgr Process Connecting To IP Check Web Services - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Trickbot"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Wermgr Process Connecting To IP Check Web Services - Rule +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590.005"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. +action.notable.param.rule_title = Wermgr Process Connecting To IP Check Web Services +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") | stats min(_time) as firstTime max(_time) as lastTime count by process_path process_name process_id QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter` + +[ESCU - Wermgr Process Create Executable File - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop executable file. This technique is commonly seen in trickbot malware where it injects it code to this process to execute it malicious behavior like downloading other payload +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027"]} +action.escu.data_models = [] +action.escu.eli5 = this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop executable file. This technique is commonly seen in trickbot malware where it injects it code to this process to execute it malicious behavior like downloading other payload +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of wermgr.exe may be used. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-04-19 +action.escu.modification_date = 2021-04-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Wermgr Process Create Executable File - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Trickbot"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Wermgr Process Create Executable File - Rule +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop executable file. This technique is commonly seen in trickbot malware where it injects it code to this process to execute it malicious behavior like downloading other payload +action.notable.param.rule_title = Wermgr Process Create Executable File +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe" | stats min(_time) as firstTime max(_time) as lastTime count by Image TargetFilename process_name dest EventCode ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_create_executable_file_filter` + +[ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-04-19 +action.escu.modification_date = 2021-04-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Trickbot"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior. +action.notable.param.rule_title = Wermgr Process Spawned CMD Or Powershell Process +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` values(Processes.process) as cmdline min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe" OR Processes.process_name = "powershell.exe" by Processes.parent_process_name Processes.parent_process_id Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_spawned_cmd_or_powershell_process_filter` + [ESCU - WinEvent Scheduled Task Created Within Public Path - Rule] action.escu = 0 action.escu.enabled = 1 @@ -15601,6 +16533,46 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe" Processes.process_name IN ("cscript.exe", "wscript.exe") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winword_spawning_windows_script_host_filter` +[ESCU - Write Executable in SMB Share - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect suspicious dropping or creating an executable file in known sensitive SMB share. This technique is commonly used for lateral movement like how trickbot try to infect other machine in the infected network. This detection catch the access event (FILE WRITE) access to a share. +action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1021.002"]} +action.escu.data_models = [] +action.escu.eli5 = This search is to detect suspicious dropping or creating an executable file in known sensitive SMB share. This technique is commonly used for lateral movement like how trickbot try to infect other machine in the infected network. This detection catch the access event (FILE WRITE) access to a share. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-04-23 +action.escu.modification_date = 2021-04-23 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Write Executable in SMB Share - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Trickbot"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Write Executable in SMB Share - Rule +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1021.002"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user'] +action.notable.param.rule_description = This search is to detect suspicious dropping or creating an executable file in known sensitive SMB share. This technique is commonly used for lateral movement like how trickbot try to infect other machine in the infected network. This detection catch the access event (FILE WRITE) access to a share. +action.notable.param.rule_title = Write Executable in SMB Share +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `write_executable_in_smb_share_filter` + [ESCU - aws detect attach to role policy - Rule] action.escu = 0 action.escu.enabled = 1 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 63f1ee161e..13db7fca83 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-04-29T21:10:45 UTC +# On Date: 2021-05-13T21:46:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index abef0ce2d5..c3fd9f16fd 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-04-29T21:10:45 UTC +# On Date: 2021-05-13T21:46:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14,7 +14,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - aws detect sts get session token abuse - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ Herein lies the rub. In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -27,7 +27,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] +searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS). It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -41,7 +41,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", "https://www.cyberark.com/resources/threat-research-blog/the-cloud-shadow-admin-threat-10-permissions-to-protect", "https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS UpdateLoginProfile - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule"] +searches = ["ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS UpdateLoginProfile - Rule"] description = This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation. narrative = Amazon Web Services provides a neat feature called Identity and Access Management (IAM) that enables organizations to manage various AWS services and resources in a secure way. All IAM users have roles, groups and policies associated with them which governs and sets permissions to allow a user to access specific restrictions.\ However, if these IAM policies are misconfigured and have specific combinations of weak permissions; it can allow attackers to escalate their privileges and further compromise the organization. Rhino Security Labs have published comprehensive blogs detailing various AWS Escalation methods. By using this as an inspiration, Splunk’s research team wants to highlight how these attack vectors look in AWS Cloudtrail logs and provide you with detection queries to uncover these potentially malicious events via this Analytic Story. \ @@ -53,7 +53,7 @@ version = 2 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -75,7 +75,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get All AWS Activity From Region - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get All AWS Activity From Region - Response Task"] description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. narrative = Because most enterprise AWS activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary. \ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -87,13 +87,26 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new EC2 instances and increased bandwidth usage. \ Fortunately, you can leverage Amazon Web Services (AWS) CloudTrail--a tool that helps you enable governance, compliance, and risk auditing of your AWS account--to give you increased visibility into your user and resource activity by recording AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred.\ The detection searches in this Analytic Story are designed to help you uncover AWS API activities from users not listed in the identity table, as well as similar activities from disabled accounts. +[analytic_story://Active Directory Password Spraying] +category = Adversary Tactics +last_updated = 2021-04-07 +version = 1 +references = ["https://attack.mitre.org/techniques/T1110/003/", "https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/", "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}] +spec_version = 3 +searches = ["ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Failing To Authenticate From Process - Rule", "ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule"] +description = Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments. +narrative = In a password spraying attack, adversaries leverage one or a small list of commonly used / popular passwords against a large volume of usernames to acquire valid account credentials. Unlike a Brute Force attack that targets a specific user or small group of users with a large number of passwords, password spraying follows the opposite aproach and increases the chances of obtaining valid credentials while avoiding account lockouts. This allows adversaries to remain undetected if the target organization does not have the proper monitoring and detection controls in place.\ +Password Spraying can be leveraged by adversaries across different stages in an attack. It can be used to obtain an iniial access to an environment but can also be used to escalate privileges when access has been already achieved. In some scenarios, this technique capitalizes on a security policy most organizations implement, password rotation. As enterprise users change their passwords, it is possible some pick predictable, seasonal passwords such as `$CompanyNameWinter`, `Summer2021`, etc.\ +Specifically, this Analytic Story is focused on detecting possible Password Spraying attacks against Active Directory environments leveraging Windows Event Logs in the `Account Logon` and `Logon/Logoff` Advanced Audit Policy categories. It presents 9 detection analytics which can aid defenders in identifyng instances where one source user, source host or source process attempts to authenticate against a target or targets using a high, unsual, number of unique users. A user, host or process attempting to authenticate with multiple users is not common behavior for legitimate systems and should be monitored by security teams. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, multi-user systems and missconfigured systems. These should be easily spotted when first implementing the detection and addded to an allow list or lookup table. The presented detections can also be used in Threat Hunting exercises. + [analytic_story://Apache Struts Vulnerability] category = Vulnerability last_updated = 2018-12-06 @@ -101,7 +114,7 @@ version = 1 references = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Investigate Web POSTs From src - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. narrative = In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's 5th largest data breach. The target, credit giant Equifax, told investigators that it had become aware of the vulnerability two months before the attack. \ The exploit involved manipulating the `Content-Type HTTP` header to execute commands embedded in the header.\ @@ -147,7 +160,7 @@ version = 1 references = ["https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule"] +searches = ["ESCU - Detect Baron Samedit CVE-2021-3156 - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule"] description = Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and prior). As this vulnerability was committed to code in July 2011, there will be many distributions affected. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. narrative = A non-privledged user is able to execute the sudoedit command to trigger a buffer overflow. After the successful buffer overflow, they are then able to gain root privileges on the affected host. The conditions needed to be run are a trailing "\" along with shell and edit flags. Monitoring the /var/log directory on Linux hosts using the Splunk Universal Forwarder will allow you to pick up this behavior when using the provided detection. @@ -158,7 +171,7 @@ version = 1 references = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Email Info - Response Task"] +searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. narrative = While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible3phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\ You can use our adaptation of `DNSTwist`, together with the support searches in this Analytic Story, to generate permutations of specified brands and external domains. Splunk can monitor email, DNS requests, and web traffic for these permutations and provide you with early warnings and situational awareness--powerful elements of an effective defense.\ @@ -171,7 +184,7 @@ version = 1 references = ["https://www.hhs.gov/sites/default/files/analyst-note-cl0p-tlp-white.pdf", "https://securityaffairs.co/wordpress/115250/data-breach/qualys-clop-ransomware.html", "https://www.darkreading.com/attacks-breaches/qualys-is-the-latest-victim-of-accellion-data-breach/d/d-id/1340323"] maintainers = [{"company": "Teoderick Contreras, Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Clop Ransomware Known Service Name - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Clop Common Exec Parameter - Rule", "ESCU - Create Service In Suspicious File Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - High File Deletion Frequency - Rule", "ESCU - Resize ShadowStorage volume - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Ransomware Notes bulk creation - Rule"] +searches = ["ESCU - Clop Common Exec Parameter - Rule", "ESCU - Clop Ransomware Known Service Name - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Create Service In Suspicious File Path - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - High File Deletion Frequency - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - Resize ShadowStorage volume - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Clop ransomware, including looking for file writes associated with Clope, encrypting network shares, deleting and resizing shadow volume storage, registry key modification, deleting of security logs, and more. narrative = Clop ransomware campaigns targeting healthcare and other vertical sectors, involve the use of ransomware payloads along with exfiltration of data per HHS bulletin. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data. @@ -182,7 +195,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -196,7 +209,7 @@ version = 1 references = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - O365 Added Service Principal - Rule"] +searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule"] description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements. narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches. @@ -207,7 +220,7 @@ version = 1 references = ["https://www.cobaltstrike.com/", "https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/", "https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/", "https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html", "https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html", "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence", "https://github.com/zer0yu/Awesome-CobaltStrike"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Anomalous usage of 7zip - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule"] +searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - DLLHost with no Command Line Arguments with Network - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - GPUpdate with no Command Line Arguments with Network - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - SearchProtocolHost with no Command Line with Network - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule"] description = Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. Many additional variables are provided for in memory operation of the beacon implant. On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike. Not every query may be specific to Cobalt Strike the tool, but the methodologies and techniques used by it.\ Splunk Threat Research reviewed all publicly available instances of Malleabe C2 Profiles and generated a list of the most commonly used spawnto and pipenames.\ @@ -227,7 +240,7 @@ version = 1 references = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Investigate Network Traffic From src ip - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more. narrative = Conventional wisdom holds that Apple's MacOS operating system is significantly less vulnerable to attack than Windows machines. While that point is debatable, it is true that attacks against MacOS systems are much less common. However, this fact does not mean that Macs are impervious to breaches. To the contrary, research has shown that that Mac malware is increasing at an alarming rate. According to AV-test, in 2018, there were 86,865 new MacOS malware variants, up from 27,338 the year before—a 31% increase. In contrast, the independent research firm found that new Windows malware had increased from 65.17M to 76.86M during that same period, less than half the rate of growth. The bottom line is that while the numbers look a lot smaller than Windows, it's definitely time to take Mac security more seriously.\ This Analytic Story addresses the ColdRoot remote access trojan (RAT), which was uploaded to Github in 2016, but was still escaping detection by the first quarter of 2018, when a new, more feature-rich variant was discovered masquerading as an Apple audio driver. Among other capabilities, the Pascal-based ColdRoot can heist passwords from users' keychains and remotely control infected machines without detection. In the initial report of his findings, Patrick Wardle, Chief Research Officer for Digita Security, explained that the new ColdRoot RAT could start and kill processes on the breached system, spawn new remote-desktop sessions, take screen captures and assemble them into a live stream of the victim's desktop, and more.\ @@ -240,7 +253,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\ Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \ @@ -253,7 +266,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\ Because this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists. @@ -277,7 +290,7 @@ version = 1 references = ["https://github.com/splunk/cloud-datamodel-security-research"] maintainers = [{"company": "Rico Valdez, Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - New container uploaded to AWS ECR - Rule", "ESCU - GCP GCR container uploaded - Rule"] +searches = ["ESCU - GCP GCR container uploaded - Rule", "ESCU - New container uploaded to AWS ECR - Rule"] description = Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry. narrative = Container Registrys provide a way for organizations to keep customized images of their development and infrastructure environment in private. However if these repositories are misconfigured or priviledge users credentials are compromise, attackers can potentially upload implanted containers which can be deployed across the organization. These searches allow operator to monitor who, when and what was uploaded to container registry. @@ -288,7 +301,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] +searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -301,7 +314,7 @@ version = 2 references = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Processes launching netsh - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \ There is a wide range of motivations for these state-sponsored hacks, including stealing valuable corporate, military, or diplomatic dataѿall of which could confer advantages in various arenas. They may also target critical infrastructure. \ @@ -327,7 +340,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - DNS Hijack Enrichment - Response Task"] +searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Hijack Enrichment - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\ The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well. \ @@ -339,6 +352,17 @@ On January 22, 2019, the US Department of Homeland Security 2019's Cybersecurity In DNS hijacking, the attacker assumes control over an account or makes use of a DNS service exploit to make changes to DNS records. Once they gain access, attackers can substitute their own MX records, name-server records, and addresses, redirecting emails and traffic through their infrastructure, where they can read, copy, or modify information seen. They can also generate valid encryption certificates to help them avoid browser-certificate checks. In one notable attack on the Internet service provider, GoDaddy, the hackers altered Sender Policy Framework (SPF) records a relatively minor change that did not inflict excessive damage but allowed for more effective spam campaigns.\ The searches in this Analytic Story help you detect and investigate activities that may indicate that DNS hijacking has taken place within your environment. +[analytic_story://DarkSide Ransomware] +category = Malware +last_updated = 2020-06-12 +version = 1 +references = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] +spec_version = 3 +searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule"] +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware +narrative = This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload. + [analytic_story://Data Exfiltration] category = Adversary Tactics last_updated = 2020-10-21 @@ -357,7 +381,7 @@ version = 1 references = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point. @@ -379,7 +403,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://github.com/SecuraBV/CVE-2020-1472", "https://www.secura.com/blog/zero-logon", "https://nvd.nist.gov/vuln/detail/CVE-2020-1472"] maintainers = [{"company": "Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier. narrative = This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, using Netlogon Remote Protocol (MS-NRPC). This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and assign themselve high privileges that can lead to domain controller and potentially complete network takeover. The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz tool which has bee updated to carry this attack payload. @@ -390,7 +414,7 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Processes launching netsh - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. narrative = Attackers employ a variety of tactics in order to avoid detection and operate without barriers. This often involves modifying the configuration of security tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes searches that look for activity consistent with attackers attempting to disable various security mechanisms. Such activity may involve monitoring for suspicious registry activity, as this is where much of the configuration for Windows and various other programs reside, or explicitly attempting to shut down security-related services. Other times, attackers attempt various tricks to prevent specific programs from running, such as adding the certificates with which the security tools are signed to a block list (which would prevent them from running). @@ -401,7 +425,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1482/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - DSQuery Domain Discovery - Rule", "ESCU - Windows AdFind Exe - Rule", "ESCU - NLTest Domain Trust Discovery - Rule"] +searches = ["ESCU - DSQuery Domain Discovery - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Windows AdFind Exe - Rule"] description = Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. narrative = Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain. Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting. Domain trusts can be enumerated using the DSEnumerateDomainTrusts() Win32 API call, .NET methods, and LDAP. The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts. @@ -412,7 +436,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists. narrative = Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and deny lists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified. @@ -423,7 +447,7 @@ version = 1 references = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. narrative = The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/). For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \ According to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.\ @@ -447,7 +471,7 @@ version = 1 references = ["https://cloud.google.com/iam/docs/understanding-service-accounts"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Google Cloud Platform (GCP) admins manage access to GCP resources and services across the enterprise using GCP Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage GCP users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as Compute instances, the GCP Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are potentially assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -460,7 +484,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html", "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/", "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/", "https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Any Powershell DownloadString - Rule"] +searches = ["ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule"] description = HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065. narrative = On Tuesday, March 2, 2021, Microsoft released a set of security patches for its mail server, Microsoft Exchange. These patches respond to a group of vulnerabilities known to impact Exchange 2013, 2016, and 2019. It is important to note that an Exchange 2010 security update has also been issued, though the CVEs do not reference that version as being vulnerable.\ While the CVEs do not shed much light on the specifics of the vulnerabilities or exploits, the first vulnerability (CVE-2021-26855) has a remote network attack vector that allows the attacker, a group Microsoft named HAFNIUM, to authenticate as the Exchange server. Three additional vulnerabilities (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) were also identified as part of this activity. When chained together along with CVE-2021-26855 for initial access, the attacker would have complete control over the Exchange server. This includes the ability to run code as SYSTEM and write to any path on the server.\ @@ -473,7 +497,7 @@ version = 2 references = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\ These state-sponsored actors are thought to be responsible for everything from a hack on a South Korean nuclear plant to an attack on Sony in anticipation of its release of the movie "The Interview" at the end of 2014. They're also notorious for cyberespionage. In recent years, the group seems to be focused on financial crimes, such as cryptojacking.\ @@ -498,7 +522,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1105/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Suspicious Curl Network Connection - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Any Powershell DownloadFile - Rule"] +searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Suspicious Curl Network Connection - Rule"] description = Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. narrative = Ingress tool transfer is a Technique under tactic Command and Control. Behaviors will include the use of living off the land binaries to download implants or binaries over alternate communication ports. It is imperative to baseline applications on endpoints to understand what generates network activity, to where, and what is its native behavior. These utilities, when abused, will write files to disk in world writeable paths.\ During triage, review the reputation of the remote public destination IP or domain. Capture any files written to disk and perform analysis. Review other parrallel processes for additional behaviors. @@ -534,7 +558,7 @@ version = 1 references = ["https://github.com/splunk/cloud-datamodel-security-research"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster. @@ -545,7 +569,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects. @@ -556,7 +580,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities @@ -567,7 +591,7 @@ version = 2 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\ Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\ @@ -582,7 +606,7 @@ version = 4 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Any Powershell DownloadFile - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope.\ The following factors may assist you in determining whether the event is malicious: \ @@ -602,7 +626,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1036/003/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule"] +searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule"] description = Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. narrative = Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths.\ The following content is here to assist with binaries within `system32` or `syswow64` being moved to a new location or an adversary bringing a the binary in to execute.\ @@ -626,7 +650,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. narrative = It is critical to identify unauthorized software and processes running on enterprise endpoints and determine whether they are likely to be malicious. This Analytic Story requires the user to populate the Interesting Processes table within Enterprise Security with prohibited processes. An included support search will augment this data, adding information on processes thought to be malicious. This search requires data from endpoint detection-and-response solutions, endpoint data sources (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator has enabled process tracking within the System Event Audit Logs.\ It is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks. @@ -651,7 +675,7 @@ version = 2 references = ["https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/", "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"] maintainers = [{"company": "Michael Haag, Splunk", "email": "-", "name": "Patrick Bareiss"}] spec_version = 3 -searches = ["ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - Windows AdFind Exe - Rule", "ESCU - TOR Traffic - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Anomalous usage of 7zip - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Supernova Webshell - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] +searches = ["ESCU - Anomalous usage of 7zip - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - Supernova Webshell - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Windows AdFind Exe - Rule"] description = Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) of the NOBELIUM Group. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. @@ -662,7 +686,7 @@ version = 1 references = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. narrative = It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\ To get started, run the detection search to identify parent processes of `netsh.exe`. @@ -674,7 +698,7 @@ version = 1 references = ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] spec_version = 3 -searches = ["ESCU - O365 Disable MFA - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - High Number of Login Failures from a single source - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule"] +searches = ["ESCU - High Number of Login Failures from a single source - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"] description = This story is focused around detecting Office 365 Attacks. narrative = More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks. @@ -685,7 +709,7 @@ version = 2 references = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. narrative = In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\ Awareness of the Orangeworm group first surfaced in January, 2015. It has conducted targeted attacks against related industries, as well, such as pharmaceuticals and healthcare IT solution providers.\ @@ -699,7 +723,7 @@ version = 1 references = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"] maintainers = [{"company": "iDefense", "email": "-", "name": "iDefense Cyber Espionage Team"}] spec_version = 3 -searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. narrative = This story was created as a joint effort between iDefense and Splunk.\ iDefense analysts have recently discovered a Windows executable file that, upon execution, spoofs a decryption tool and then drops a file that appears to be the custom-built javascript backdoor, "Orz," which is associated with the threat actors known as MUDCARP (as well as "temp.Periscope" and "Leviathan"). The file is executed using Wscript.\ @@ -737,7 +761,7 @@ version = 1 references = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts. @@ -748,7 +772,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task"] +searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -759,7 +783,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"] maintainers = [{"company": "David Dorsey, Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources. @@ -770,7 +794,7 @@ version = 1 references = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get Notable History - Response Task"] description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers. narrative = Networking devices, such as routers and switches, are often overlooked as resources that attackers will leverage to subvert an enterprise. Advanced threats actors have shown a proclivity to target these critical assets as a means to siphon and redirect network traffic, flash backdoored operating systems, and implement cryptographic weakened algorithms to more easily decrypt network traffic.\ This Analytic Story helps you gain a better understanding of how your network devices are interacting with your hosts. By compromising your network devices, attackers can obtain direct access to the company's internal infrastructure— effectively increasing the attack surface and accessing private services/data. @@ -782,7 +806,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more. narrative = Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) on October 28th called “Ransomware Activity Targeting the Healthcare and Public Health Sector.” This alert details TTPs associated with ongoing and possible imminent attacks against the Healthcare sector, and is a joint advisory in coordination with other U.S. Government agencies. The objective of these malicious campaigns is to infiltrate targets in named sectors and to drop ransomware payloads, which will likely cause disruption of service and increase risk of actual harm to the health and safety of patients at hospitals, even with the aggravant of an ongoing COVID-19 pandemic. This document specifically refers to several crimeware exploitation frameworks, emphasizing the use of Ryuk ransomware as payload. The Ryuk ransomware payload is not new. It has been well documented and identified in multiple variants. Payloads need a carrier, and for Ryuk it has often been exploitation frameworks such as Cobalt Strike, or popular crimeware frameworks such as Emotet or Trickbot. @@ -805,7 +829,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - File with Samsam Extension - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task"] +searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\ Although categorized under the heading of ransomware, SamSam campaigns have some importance distinguishing characteristics. Most notable is the fact that conventional ransomware is a numbers game. Perpetrators use a "spray-and-pray" approach with phishing campaigns or other mechanisms, charging a small ransom (typically under $1,000). The goal is to find a large number of victims willing to pay these mini-ransoms, adding up to a lucrative payday. They use relatively simple methods for infecting systems.\ @@ -821,7 +845,7 @@ version = 1 references = ["https://redcanary.com/blog/clipping-silver-sparrows-wings/", "https://www.sentinelone.com/blog/5-things-you-need-to-know-about-silver-sparrow/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious PlistBuddy Usage via OSquery - Rule", "ESCU - Suspicious Curl Network Connection - Rule", "ESCU - Suspicious SQLite3 LSQuarantine Behavior - Rule", "ESCU - Suspicious PlistBuddy Usage - Rule"] +searches = ["ESCU - Suspicious Curl Network Connection - Rule", "ESCU - Suspicious PlistBuddy Usage - Rule", "ESCU - Suspicious PlistBuddy Usage via OSquery - Rule", "ESCU - Suspicious SQLite3 LSQuarantine Behavior - Rule"] description = Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence. narrative = Silver Sparrow works is a dropper and uses typical persistence mechanisms on a Mac. It is cross platform, covering both Intel and Apple M1 architecture. To this date, no implant has been downloaded for malicious purposes. During installation of the update.pkg or updater.pkg file, the malicious software utilizes JavaScript to generate files and scripts on disk for persistence.These files later download a implant from an S3 bucket every hour. This analytic assists with identifying different types of macOS malware families establishing LaunchAgent persistence. Per SentinelOne source, it is predicted that Silver Sparrow is likely selling itself as a mechanism to 3rd party “affiliates” or pay-per-install (PPI) partners, typically seen as commodity adware/malware. Additional indicators and behaviors may be found within the references. @@ -832,7 +856,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}] spec_version = 3 -searches = ["ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Excel Spawning PowerShell - Rule", "ESCU - Detect Outlook exe writing a zip file - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Office Document Creating Schedule Task - Rule"] +searches = ["ESCU - Detect Outlook exe writing a zip file - Rule", "ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ @@ -881,7 +905,7 @@ version = 1 references = ["https://nvd.nist.gov/vuln/detail/CVE-2018-11409", "https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings", "https://www.exploit-db.com/exploits/44865/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Investigate Network Traffic From src ip - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users. narrative = Although there have been no reports of it being exploited, Splunk Enterprise versions through 7.0.1 reportedly have a vulnerability that may expose information through a REST endpoint (read more here: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings). NIST has included it in its vulnerability database (read more here: https://nvd.nist.gov/vuln/detail/CVE-2018-11409). The REST endpoint that exposes system information is also necessary for the proper operation of Splunk clustering and instrumentation. Customers should upgrade to the latest version to reduce the risk of this vulnerability.\ Splunk Enterprise exposes partial information about the host operating system, hardware, and Splunk license. Splunk Enterprise before 6.6.0 exposes this information without authentication. Splunk Enterprise 6.6.0 and later exposes this information only to authenticated Splunk users. Based on the information exposure, Splunk characterizes this issue as a low severity impact.\ @@ -895,7 +919,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] +searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and risk auditing within your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Console, AWS command-line interface, and AWS SDKs and APIs to ensure that your EC2 instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your AWS EC2 instances and helps you respond and investigate those activities. @@ -906,7 +930,7 @@ version = 1 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. @@ -917,7 +941,7 @@ version = 2 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ @@ -930,7 +954,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). narrative = A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \ Amazon's VPC service enables you to launch EC2 instances and leverage other Amazon resources. The traffic that flows in and out of this VPC can be controlled via network access-control rules and security groups. Amazon also has a feature called VPC Flow Logs that enables you to log IP traffic going to and from the network interfaces in your VPC. This data is stored using Amazon CloudWatch Logs.\ @@ -944,7 +968,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\ This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS. @@ -956,7 +980,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities. @@ -967,7 +991,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get Notable History - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -979,7 +1003,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Detect and investigate suspicious activities by users and roles in your cloud environments. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage. @@ -991,7 +1015,7 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation. @@ -1002,7 +1026,7 @@ version = 1 references = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness). However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses. @@ -1013,7 +1037,7 @@ version = 1 references = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Email Info - Response Task"] +searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. narrative = It is a common practice for attackers of all types to leverage targeted spearphishing campaigns and mass mailers to deliver weaponized email messages and attachments. Fortunately, there are a number of ways to monitor email data in Splunk to detect suspicious content.\ Once a phishing message has been detected, the next steps are to answer the following questions: \ @@ -1039,7 +1063,7 @@ version = 2 references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"] maintainers = [{"company": "Michael Haag, Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect mshta renamed - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. narrative = One common adversary tactic is to bypass application control solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code.\ @@ -1062,7 +1086,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task"] +searches = ["ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"] description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors. narrative = Okta is the leading single sign on (SSO) provider, allowing users to authenticate once to Okta, and from there access a variety of web-based applications. These applications are assigned to users and allow administrators to centrally manage which users are allowed to access which applications. It also provides centralized logging to help understand how the applications are used and by whom. \ While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \ @@ -1086,7 +1110,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1218/011/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md", "https://lolbas-project.github.io/lolbas/Binaries/Rundll32"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule"] +searches = ["ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Rundll32 with no Command Line Arguments with Network - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule"] description = Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code. narrative = One common adversary tactic is to bypass application control solutions via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging rundll32.exe to execute malicious code. @@ -1097,7 +1121,7 @@ version = 2 references = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - WMI Permanent Event Subscription - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. \ The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems.\ @@ -1110,7 +1134,7 @@ version = 1 references = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\ The registry is a key component of the Windows operating system. It has a hierarchical database called "registry" that contains settings, options, and values for executables. Once the threat actor gains access to a machine, they can use reg.exe to modify their account to obtain administrator-level privileges, maintain persistence, and move laterally within the environment.\ @@ -1128,6 +1152,17 @@ description = Attackers are using Zoom as an vector to increase privileges on a narrative = Zoom is a leader in modern enterprise video communications and its usage has increased dramatically with a large amount of the population under stay-at-home orders due to the COVID-19 pandemic. With increased usage has come increased scrutiny and several security flaws have been found with this application on both Windows and macOS systems.\ Current detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation. +[analytic_story://Trickbot] +category = Malware +last_updated = 2021-04-20 +version = 1 +references = ["https://en.wikipedia.org/wiki/Trickbot", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"] +maintainers = [{"company": "Teoderick Contreras, Splunk", "email": "-", "name": "Rod Soto"}] +spec_version = 3 +searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Powershell Remote Thread To Known Windows Process - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Trickbot Named Pipe - Rule", "ESCU - Wermgr Process Connecting To IP Check Web Services - Rule", "ESCU - Wermgr Process Create Executable File - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Write Executable in SMB Share - Rule"] +description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment. +narrative = trickbot banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS where target security Microsoft Defender to prevent its detection and removal. steal Verizon credentials and targeting banks using its multi component modules that collect and exfiltrate data. + [analytic_story://Trusted Developer Utilities Proxy Execution] category = Adversary Tactics last_updated = 2021-01-12 @@ -1135,7 +1170,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1127/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md", "https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious microsoft workflow compiler usage - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule"] +searches = ["ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious microsoft workflow compiler usage - Rule"] description = Monitor and detect behaviors used by attackers who leverage trusted developer utilities to execute malicious code. narrative = Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.\ The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging microsoft.workflow.compiler.exe to execute malicious code. @@ -1147,7 +1182,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1127/001/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md", "https://github.com/infosecn1nja/MaliciousMacroMSBuild", "https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1", "https://lolbas-project.github.io/lolbas/Binaries/Msbuild/", "https://github.com/MHaggis/CBR-Queries/blob/master/msbuild.md"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule"] +searches = ["ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious msbuild path - Rule"] description = Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code. narrative = Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.\ The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.\ @@ -1183,7 +1218,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\ This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\ @@ -1196,7 +1231,7 @@ version = 1 references = ["https://www.monkey.org/~dugsong/dsniff/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted. narrative = Various legacy protocols operate by default in the clear, without the protections of encryption. This potentially leaks sensitive information that can be exploited by passively sniffing network traffic. Depending on the protocol, this information could be highly sensitive, or could allow for session hijacking. In addition, these protocols send authentication information, which would allow for the harvesting of usernames and passwords that could potentially be used to authenticate and compromise secondary systems. @@ -1207,7 +1242,7 @@ version = 1 references = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jim Apger"}] spec_version = 3 -searches = ["ESCU - Web Fraud - Password Sharing Across Accounts - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Get Web Session Information via session id - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"] +searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Web Session Information via session id - Response Task"] description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. narrative = The Federal Bureau of Investigations (FBI) defines Internet fraud as the use of Internet services or software with Internet access to defraud victims or to otherwise take advantage of them. According to the Bureau, Internet crime schemes are used to steal millions of dollars each year from victims and continue to plague the Internet through various methods. The agency includes phishing scams, data breaches, Denial of Service (DOS) attacks, email account compromise, malware, spoofing, and ransomware in this category.\ These crimes are not the fraud itself, but rather the attack techniques commonly employed by fraudsters in their pursuit of data that enables them to commit malicious actssuch as obtaining and using stolen credit cards. They represent a serious problem that is steadily increasing and not likely to go away anytime soon.\ @@ -1223,7 +1258,7 @@ version = 1 references = ["https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", "https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise. The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit. narrative = When a client requests a DNS record for a particular domain, that request gets routed first through the client's locally configured DNS server, then to any DNS server(s) configured as forwarders, and then onto the target domain's own DNS server(s). If a attacker wanted to, they could host a malicious DNS server that responds to the initial request with a specially crafted large response (~65KB). This response would flow through to the client's local DNS server, which if not patched for CVE-2020-1350, would cause the buffer overflow. The detection searches in this Analytic Story use wire data to detect the malicious behavior. Searches for Splunk Stream and Zeek are included. The Splunk Stream search correlates across stream:dns and stream:tcp, while the Zeek search correlates across bro:dns:json and bro:conn:json. These correlations are required to pick up both the DNS record types (SIG and KEY) along with the payload size (>65KB). @@ -1234,7 +1269,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -1245,7 +1280,7 @@ version = 1 references = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques. narrative = Attackers use a variety of techniques to entice users to run malicious code or to persist on an endpoint. One way to accomplish these goals is to leverage file extensions and the mechanism Windows uses to associate files with specific applications. \ Since its earliest days, Windows has used extensions to identify file types. Users have become familiar with these extensions and their application associations. For example, if users see that a file ends in `.doc` or `.docx`, they will assume that it is a Microsoft Word document and expect that double-clicking will open it using `winword.exe`. The user will typically also presume that the `.docx` file is safe. \ @@ -1260,7 +1295,7 @@ version = 2 references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. narrative = Because attackers often modify system logs to cover their tracks and/or to thwart the investigative process, log monitoring is an industry-recognized best practice. While there are legitimate reasons to manipulate system logs, it is still worthwhile to keep track of who manipulated the logs, when they manipulated them, and in what way they manipulated them (determining which accesses, tools, or utilities were employed). Even if no malicious activity is detected, the knowledge of an attempt to manipulate system logs may be indicative of a broader security risk that should be thoroughly investigated.\ The Analytic Story gives users two different ways to detect manipulation of Windows Event Logs and one way to detect deletion of the Update Sequence Number (USN) Change Journal. The story helps determine the history of the host and the users who have accessed it. Finally, the story aides in investigation by retrieving all the information on the process that caused these events (if the process has been identified). @@ -1272,7 +1307,7 @@ version = 2 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Shedule Task with HTTP Command Arguments - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment. @@ -1283,7 +1318,7 @@ version = 2 references = ["https://attack.mitre.org/tactics/TA0004/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. narrative = Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment. @@ -1294,7 +1329,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner. narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection. @@ -1626,6 +1661,16 @@ annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Ob known_false_positives = Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. providing_technologies = [] +[savedsearch://ESCU - Account Discovery With Net App - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002"]} +known_false_positives = admin or power user may used this series of command. +providing_technologies = [] + [savedsearch://ESCU - Amazon EKS Kubernetes Pod scan detection - Rule] type = detection asset_type = Amazon EKS Kubernetes cluster Pod @@ -1746,6 +1791,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_att known_false_positives = It is possible for this search to generate a notable event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary. providing_technologies = [] +[savedsearch://ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} +known_false_positives = Legitimate windows application that are not on the list loading this dll. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - CertUtil Download With URLCache and Split Arguments - Rule] type = detection asset_type = @@ -2152,6 +2207,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"]} known_false_positives = Limited false positives. If there is a true false positive, filter based on command-line or parent process. providing_technologies = [] +[savedsearch://ESCU - Delete ShadowCopy With PowerShell - Rule] +type = detection +asset_type = +confidence = medium +explanation = This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Deleting Shadow Copies - Rule] type = detection asset_type = Endpoint @@ -2582,6 +2647,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = Administrators can leverage PsExec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this event on a machine providing_technologies = [] +[savedsearch://ESCU - Detect RClone Command-Line Usage - Rule] +type = detection +asset_type = +confidence = medium +explanation = This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} +known_false_positives = There is potential for false positives as these arguments may be used by other applications. Filter or tune the analytic as needed. +providing_technologies = [] + [savedsearch://ESCU - Detect Rare Executables - Rule] type = detection asset_type = Endpoint @@ -2663,6 +2738,16 @@ annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on O known_false_positives = Limited false positives related to third party software registering .DLL's. providing_technologies = [] +[savedsearch://ESCU - Detect Renamed RClone - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from the legitimate site and executed accordingly. During triage, isolate the endpoint and begin to review parallel processes for additional behavior. At this stage, the adversary may have staged data to be exfiltrated. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} +known_false_positives = False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case. +providing_technologies = [] + [savedsearch://ESCU - Detect Rogue DHCP Server - Rule] type = detection asset_type = Infrastructure @@ -3321,6 +3406,16 @@ annotations = {"cis20": ["CIS 10"], "nist": ["PR.IP"]} known_false_positives = None identified providing_technologies = [] +[savedsearch://ESCU - Extract SAM from Registry - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from a untrusted process or script. Upon execution, a file will be written to disk. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} +known_false_positives = It is possible some agent based products will generate false positives. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - File with Samsam Extension - Rule] type = detection asset_type = Endpoint @@ -3835,6 +3930,45 @@ annotations = {"kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.00 known_false_positives = Normal archive transfer via HTTP protocol may trip this detection. providing_technologies = [] +[savedsearch://ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems. +providing_technologies = [] + +[savedsearch://ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems. +providing_technologies = [] + +[savedsearch://ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies one source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC0000064 stands for `The username you typed does not exist` (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. +providing_technologies = [] + [savedsearch://ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule] type = detection asset_type = Infrastructure @@ -3845,6 +3979,71 @@ annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE. known_false_positives = A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` to raise the threshold or except specific IP adresses from triggering this search. providing_technologies = [] +[savedsearch://ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. +how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. +providing_technologies = [] + +[savedsearch://ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, missconfigured systems and multi-user systems like Citrix farms. +providing_technologies = [] + +[savedsearch://ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. +providing_technologies = [] + +[savedsearch://ESCU - Multiple Users Failing To Authenticate From Process - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies a source process name failing to authenticate with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 generates on domain controllers, member servers, and workstations when an account fails to logon. Logon Type 2 describes an iteractive logon attempt.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed. This could be a domain controller as well as a member server or workstation.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A process failing to authenticate with multiple users is not a common behavior for legitimate user sessions. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. +providing_technologies = [] + +[savedsearch://ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies a source host failing to authenticate against a remote host with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 describes an remote authentication attempt.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server or workstation.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} +known_false_positives = A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc. +providing_technologies = [] + [savedsearch://ESCU - NLTest Domain Trust Discovery - Rule] type = detection asset_type = Endpoint @@ -4177,6 +4376,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"]} known_false_positives = Limited false positives. It is possible administrators will utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent process or command-line arguments. providing_technologies = [] +[savedsearch://ESCU - Powershell Remote Thread To Known Windows Process - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, Create Remote thread from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of create remote thread may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Process Creating LNK file in Suspicious Location - Rule] type = detection asset_type = Endpoint @@ -4447,6 +4656,26 @@ annotations = {"kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre known_false_positives = Limited to no known false positives. providing_technologies = [] +[savedsearch://ESCU - SLUI RunAs Elevated - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This particular bypass utilizes a registry key/value. Identified by two sources, the registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`. To simulate this behavior, multiple POC are available. The analytic identifies the use of `runas` by `slui.exe`. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +known_false_positives = Limited false positives should be present as this is not commonly used by legitimate applications. +providing_technologies = [] + +[savedsearch://ESCU - SLUI Spawning a Process - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, spawning a child process. This behavior is associated with publicly known UAC bypass. `slui.exe` is commonly associated with software updates and is most often spawned by `svchost.exe`. The `slui.exe` process should not have child processes, and any processes spawning from it will be running with elevated privileges. During triage, review the child process and additional parallel processes. Identify any file modifications that may have lead to the bypass. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +known_false_positives = Certain applications may spawn from `slui.exe` that are legitimate. Filtering will be needed to ensure proper monitoring. +providing_technologies = [] + [savedsearch://ESCU - SMB Traffic Spike - Rule] type = detection asset_type = Endpoint @@ -4500,6 +4729,26 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Inst known_false_positives = Using sc.exe to manipulate Windows services is uncommon. However, there may be legitimate instances of this behavior. It is important to validate and investigate as appropriate. providing_technologies = [] +[savedsearch://ESCU - Schedule Task with HTTP Command Arguments - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' +how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - Schedule Task with Rundll32 Command Trigger - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' +how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Scheduled Task Deleted Or Created via CMD - Rule] type = detection asset_type = Endpoint @@ -4570,16 +4819,6 @@ annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Installation" known_false_positives = Administrators may attempt to change the default execution policy on a system for a variety of reasons. However, setting the policy to "unrestricted" or "bypass" as this search is designed to identify, would be unusual. Hits should be reviewed and investigated as appropriate. providing_technologies = [] -[savedsearch://ESCU - Shedule Task with HTTP Command Arguments - Rule] -type = detection -asset_type = -confidence = medium -explanation = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine.\ The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' -how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. -annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} -known_false_positives = unknown -providing_technologies = [] - [savedsearch://ESCU - Shim Database File Creation - Rule] type = detection asset_type = Endpoint @@ -5008,6 +5247,16 @@ annotations = {"cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and known_false_positives = None at this time providing_technologies = [] +[savedsearch://ESCU - Trickbot Named Pipe - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. . +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - USN Journal Deletion - Rule] type = detection asset_type = Endpoint @@ -5188,6 +5437,36 @@ annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = Some of these processes may be used legitimately on web servers during maintenance or other administrative tasks. providing_technologies = [] +[savedsearch://ESCU - Wermgr Process Connecting To IP Check Web Services - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590.005"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - Wermgr Process Create Executable File - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop executable file. This technique is commonly seen in trickbot malware where it injects it code to this process to execute it malicious behavior like downloading other payload +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of wermgr.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - WinEvent Scheduled Task Created Within Public Path - Rule] type = detection asset_type = @@ -5306,6 +5585,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.00 known_false_positives = There will be limited false positives and it will be different for every environment. Tune by child process or command-line as needed. providing_technologies = [] +[savedsearch://ESCU - Write Executable in SMB Share - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect suspicious dropping or creating an executable file in known sensitive SMB share. This technique is commonly used for lateral movement like how trickbot try to infect other machine in the infected network. This detection catch the access event (FILE WRITE) access to a share. +how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. +annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1021.002"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - aws detect attach to role policy - Rule] type = detection asset_type = AWS Account diff --git a/dist/escu/lookups/mitre_enrichment.csv b/dist/escu/lookups/mitre_enrichment.csv index 5347a9e765..0717cbc6ba 100644 --- a/dist/escu/lookups/mitre_enrichment.csv +++ b/dist/escu/lookups/mitre_enrichment.csv @@ -1,182 +1,59 @@ mitre_id,technique,tactics,groups -T1553.006,Code Signing Policy Modification,Defense Evasion,Turla|APT39 -T1614,System Location Discovery,Discovery,no -T1613,Container and Resource Discovery,Discovery,no -T1552.007,Container API,Credential Access,no -T1612,Build Image on Host,Defense Evasion,no -T1611,Escape to Host,Privilege Escalation,no -T1204.003,Malicious Image,Execution,no -T1053.007,Container Orchestration Job,Execution|Persistence|Privilege Escalation,no -T1610,Deploy Container,Defense Evasion|Execution,no -T1609,Container Administration Command,Execution,no -T1608.005,Link Target,Resource Development,Silent Librarian -T1608.004,Drive-by Target,Resource Development,APT32|Threat Group-3390 -T1608.003,Install Digital Certificate,Resource Development,no -T1608.002,Upload Tool,Resource Development,Threat Group-3390 -T1608.001,Upload Malware,Resource Development,APT32 -T1608,Stage Capabilities,Resource Development,no -T1016.001,Internet Connection Discovery,Discovery,APT29|UNC2452|Turla -T1553.005,Mark-of-the-Web Bypass,Defense Evasion,TA505 -T1555.005,Password Managers,Credential Access,Fox Kitten|Operation Wocao -T1484.002,Domain Trust Modification,Defense Evasion|Privilege Escalation,APT29|UNC2452 -T1484.001,Group Policy Modification,Defense Evasion|Privilege Escalation,Indrik Spider -T1547.014,Active Setup,Persistence|Privilege Escalation,no -T1606.002,SAML Tokens,Credential Access,APT29|UNC2452 -T1606.001,Web Cookies,Credential Access,APT29|UNC2452 -T1606,Forge Web Credentials,Credential Access,no -T1555.004,Windows Credential Manager,Credential Access,Stealth Falcon|OilRig|Turla -T1059.008,Network Device CLI,Execution,no -T1602.002,Network Device Configuration Dump,Collection,no -T1542.005,TFTP Boot,Defense Evasion|Persistence,no -T1542.004,ROMMONkit,Defense Evasion|Persistence,no -T1602.001,SNMP (MIB Dump),Collection,no -T1602,Data from Configuration Repository,Collection,no -T1601.002,Downgrade System Image,Defense Evasion,no -T1601.001,Patch System Image,Defense Evasion,no -T1601,Modify System Image,Defense Evasion,no -T1600.002,Disable Crypto Hardware,Defense Evasion,no -T1600.001,Reduce Key Space,Defense Evasion,no -T1600,Weaken Encryption,Defense Evasion,no -T1556.004,Network Device Authentication,Credential Access|Defense Evasion|Persistence,no -T1599.001,Network Address Translation Traversal,Defense Evasion,no -T1599,Network Boundary Bridging,Defense Evasion,no -T1020.001,Traffic Duplication,Exfiltration,no -T1557.002,ARP Cache Poisoning,Credential Access|Collection,Cleaver -T1588.006,Vulnerabilities,Resource Development,Sandworm Team -T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no -T1562.008,Disable Cloud Logs,Defense Evasion,no -T1547.012,Print Processors,Persistence|Privilege Escalation,no -T1598.003,Spearphishing Link,Reconnaissance,Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky -T1598.002,Spearphishing Attachment,Reconnaissance,Sidewinder -T1598.001,Spearphishing Service,Reconnaissance,no -T1598,Phishing for Information,Reconnaissance,ZIRCONIUM|APT28 -T1597.002,Purchase Technical Data,Reconnaissance,no -T1597.001,Threat Intel Vendors,Reconnaissance,no -T1597,Search Closed Sources,Reconnaissance,no -T1596.005,Scan Databases,Reconnaissance,no -T1596.004,CDNs,Reconnaissance,no -T1596.003,Digital Certificates,Reconnaissance,no -T1596.001,DNS/Passive DNS,Reconnaissance,no -T1596.002,WHOIS,Reconnaissance,no -T1596,Search Open Technical Databases,Reconnaissance,no -T1595.002,Vulnerability Scanning,Reconnaissance,Volatile Cedar|APT28|Sandworm Team -T1595.001,Scanning IP Blocks,Reconnaissance,no -T1595,Active Scanning,Reconnaissance,no -T1594,Search Victim-Owned Websites,Reconnaissance,Silent Librarian|Sandworm Team -T1593.002,Search Engines,Reconnaissance,no -T1593.001,Social Media,Reconnaissance,no -T1593,Search Open Websites/Domains,Reconnaissance,Sandworm Team -T1592.004,Client Configurations,Reconnaissance,HAFNIUM -T1592.003,Firmware,Reconnaissance,no -T1592.002,Software,Reconnaissance,Sandworm Team -T1592.001,Hardware,Reconnaissance,no -T1592,Gather Victim Host Information,Reconnaissance,no -T1591.004,Identify Roles,Reconnaissance,no -T1591.003,Identify Business Tempo,Reconnaissance,no -T1591.001,Determine Physical Locations,Reconnaissance,no -T1591.002,Business Relationships,Reconnaissance,Sandworm Team -T1591,Gather Victim Org Information,Reconnaissance,no -T1590.006,Network Security Appliances,Reconnaissance,no -T1590.005,IP Addresses,Reconnaissance,HAFNIUM -T1590.004,Network Topology,Reconnaissance,no -T1590.003,Network Trust Dependencies,Reconnaissance,no -T1590.002,DNS,Reconnaissance,no -T1590.001,Domain Properties,Reconnaissance,Sandworm Team -T1590,Gather Victim Network Information,Reconnaissance,HAFNIUM -T1589.003,Employee Names,Reconnaissance,Silent Librarian|Sandworm Team -T1589.002,Email Addresses,Reconnaissance,TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team -T1589.001,Credentials,Reconnaissance,APT28|Magic Hound|Chimera -T1589,Gather Victim Identity Information,Reconnaissance,APT32 -T1588.005,Exploits,Resource Development,no -T1588.004,Digital Certificates,Resource Development,Lazarus Group|Silent Librarian -T1588.003,Code Signing Certificates,Resource Development,Wizard Spider -T1588.002,Tool,Resource Development,MuddyWater|Silent Librarian|GALLIUM|Sandworm Team -T1588.001,Malware,Resource Development,Turla|APT1 -T1588,Obtain Capabilities,Resource Development,no -T1587.004,Exploits,Resource Development,no -T1587.003,Digital Certificates,Resource Development,APT29|PROMETHIUM -T1587.002,Code Signing Certificates,Resource Development,PROMETHIUM|Patchwork -T1587.001,Malware,Resource Development,APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver -T1587,Develop Capabilities,Resource Development,Kimsuky -T1586.002,Email Accounts,Resource Development,Magic Hound|Kimsuky -T1586.001,Social Media Accounts,Resource Development,no -T1586,Compromise Accounts,Resource Development,no -T1585.002,Email Accounts,Resource Development,Magic Hound|Silent Librarian|Sandworm Team|APT1 -T1585.001,Social Media Accounts,Resource Development,Fox Kitten|Sandworm Team|APT32|Cleaver -T1585,Establish Accounts,Resource Development,Fox Kitten|APT17 -T1584.006,Web Services,Resource Development,Turla -T1584.005,Botnet,Resource Development,no -T1584.004,Server,Resource Development,Indrik Spider|Turla|APT16 -T1584.003,Virtual Private Server,Resource Development,Turla -T1584.002,DNS Server,Resource Development,no -T1584.001,Domains,Resource Development,APT29|UNC2452|APT1 -T1583.006,Web Services,Resource Development,ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29 -T1583.005,Botnet,Resource Development,no -T1583.004,Server,Resource Development,GALLIUM|Sandworm Team -T1583.003,Virtual Private Server,Resource Development,HAFNIUM|TEMP.Veles -T1583.002,DNS Server,Resource Development,no -T1584,Compromise Infrastructure,Resource Development,no -T1583.001,Domains,Resource Development,APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28 -T1583,Acquire Infrastructure,Resource Development,no -T1564.007,VBA Stomping,Defense Evasion,no -T1558.004,AS-REP Roasting,Credential Access,no -T1580,Cloud Infrastructure Discovery,Discovery,no -T1218.012,Verclsid,Defense Evasion,no -T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,PROMETHIUM +T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,no T1564.006,Run Virtual Instance,Defense Evasion,no T1564.005,Hidden File System,Defense Evasion,Strider|Equation -T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion|Persistence,no +T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion,no T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Mockingbird T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no T1098.004,SSH Authorized Keys,Persistence,no T1480.001,Environmental Keying,Defense Evasion,APT41|Equation -T1059.007,JavaScript,Execution,MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer +T1059.007,JavaScript/JScript,Execution,APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer T1578.004,Revert Cloud Instance,Defense Evasion,no T1578.003,Delete Cloud Instance,Defense Evasion,no T1578.001,Create Snapshot,Defense Evasion,no T1578.002,Create Cloud Instance,Defense Evasion,no T1127.001,MSBuild,Defense Evasion,Frankenstein -T1027.005,Indicator Removal from Tools,Defense Evasion,Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda +T1027.005,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda T1562.006,Indicator Blocking,Defense Evasion,no -T1573.002,Asymmetric Cryptography,Command And Control,Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 -T1573.001,Symmetric Cryptography,Command And Control,Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group +T1573.002,Asymmetric Cryptography,Command And Control,Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 +T1573.001,Symmetric Cryptography,Command And Control,Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group T1573,Encrypted Channel,Command And Control,Tropic Trooper T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28 -T1071.004,DNS,Command And Control,Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 -T1071.003,Mail Protocols,Command And Control,Turla|Kimsuky|APT32|SilverTerrier|APT28 -T1071.002,File Transfer Protocols,Command And Control,Kimsuky|APT41|SilverTerrier|Honeybee -T1071.001,Web Protocols,Command And Control,APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Ke3chang|Orangeworm|APT19|Cobalt Group|Threat Group-3390|Rancor|APT37|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|Magic Hound|APT32|OilRig|Gamaredon Group|Stealth Falcon -T1572,Protocol Tunneling,Command And Control,Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6 -T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group -T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT29|UNC2452 +T1071.004,DNS,Command And Control,APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 +T1071.003,Mail Protocols,Command And Control,APT32|SilverTerrier|APT28 +T1071.002,File Transfer Protocols,Command And Control,APT41|SilverTerrier|Machete|Honeybee +T1071.001,Web Protocols,Command And Control,Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon +T1572,Protocol Tunneling,Command And Control,OilRig|Cobalt Group|FIN6 +T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group +T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,no T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no -T1001.003,Protocol Impersonation,Command And Control,Higaisa|Lazarus Group -T1001.002,Steganography,Command And Control,APT29|Axiom +T1001.003,Protocol Impersonation,Command And Control,Lazarus Group +T1001.002,Steganography,Command And Control,Axiom T1001.001,Junk Data,Command And Control,APT28 T1132.002,Non-Standard Encoding,Command And Control,no -T1132.001,Standard Encoding,Command And Control,HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork +T1132.001,Standard Encoding,Command And Control,Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork T1090.004,Domain Fronting,Command And Control,APT29 -T1090.003,Multi-hop Proxy,Command And Control,APT28|Operation Wocao|Inception|FIN4|APT29 -T1090.002,External Proxy,Command And Control,APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 -T1090.001,Internal Proxy,Command And Control,APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider +T1090.003,Multi-hop Proxy,Command And Control,Inception|FIN4|APT29 +T1090.002,External Proxy,Command And Control,APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 +T1090.001,Internal Proxy,Command And Control,APT39|Strider T1102.003,One-Way Communication,Command And Control,Leviathan -T1102.002,Bidirectional Communication,Command And Control,ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak +T1102.002,Bidirectional Communication,Command And Control,Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7 -T1074.002,Remote Data Staging,Collection,APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 -T1074.001,Local Data Staging,Collection,Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28 +T1074.002,Remote Data Staging,Collection,Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 +T1074.001,Local Data Staging,Collection,Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28 T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT33 T1564.004,NTFS File Attributes,Defense Evasion,APT32 -T1564.003,Hidden Window,Defense Evasion,Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound -T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32 -T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314 +T1564.003,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound +T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Tropic Trooper|FIN10|Stolen Pencil|APT32 +T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,TA505|APT3|Threat Group-1314 T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no T1564.002,Hidden Users,Defense Evasion,no -T1574.006,Dynamic Linker Hijacking,Persistence|Privilege Escalation|Defense Evasion,APT41|Rocke -T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390 -T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass +T1574.006,LD_PRELOAD,Persistence|Privilege Escalation|Defense Evasion,Rocke +T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390 +T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Whitefly|RTM|Threat Group-3390|menuPass T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no @@ -184,174 +61,174 @@ T1574.011,Services Registry Permissions Weakness,Persistence|Privilege Escalatio T1574.005,Executable Installer File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no T1574.010,Services File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no -T1069.001,Local Groups,Discovery,Chimera|Operation Wocao|Turla|OilRig|admin@338 -T1570,Lateral Tool Transfer,Lateral Movement,Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10 +T1069.001,Local Groups,Discovery,Turla|OilRig|admin@338 +T1570,Lateral Tool Transfer,Lateral Movement,APT32|Wizard Spider|Turla|FIN10 T1568.003,DNS Calculation,Command And Control,APT12 -T1204.002,Malicious File,Execution,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Dragonfly 2.0|Dark Caracal|Cobalt Group|DarkHydrus|OilRig|Rancor|BRONZE BUTLER|FIN7|APT19|Patchwork|APT32|Gorgon Group|MuddyWater|Lazarus Group|APT37|TA459|Leviathan|APT29|APT28|FIN8|Elderwood|PLATINUM|menuPass -T1204.001,Malicious Link,Execution,APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|Turla|APT33 +T1204.002,Malicious File,Execution,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM +T1204.001,Malicious Link,Execution,Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla T1195.003,Compromise Hardware Supply Chain,Initial Access,no -T1195.002,Compromise Software Supply Chain,Initial Access,APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41 +T1195.002,Compromise Software Supply Chain,Initial Access,Sandworm Team|APT41 T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no -T1568.001,Fast Flux DNS,Command And Control,menuPass|TA505 -T1052.001,Exfiltration over USB,Exfiltration,Mustang Panda|Tropic Trooper -T1569.002,Service Execution,Execution,Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang +T1568.001,Fast Flux DNS,Command And Control,TA505 +T1052.001,Exfiltration over USB,Exfiltration,Tropic Trooper +T1569.002,Service Execution,Execution,Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang T1569.001,Launchctl,Execution,no T1569,System Services,Execution,no -T1568.002,Domain Generation Algorithms,Command And Control,TA551|APT41 -T1568,Dynamic Resolution,Command And Control,APT29|UNC2452 +T1568.002,Domain Generation Algorithms,Command And Control,APT41 +T1568,Dynamic Resolution,Command And Control,no T1011.001,Exfiltration Over Bluetooth,Exfiltration,no -T1567.002,Exfiltration to Cloud Storage,Exfiltration,ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla +T1567.002,Exfiltration to Cloud Storage,Exfiltration,Leviathan|Turla T1567.001,Exfiltration to Code Repository,Exfiltration,no -T1059.006,Python,Execution,ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete -T1059.005,Visual Basic,Execution,Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound +T1059.006,Python,Execution,Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete +T1059.005,Visual Basic,Execution,APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound T1059.004,Unix Shell,Execution,Rocke|APT41 -T1059.003,Windows Command Shell,Execution,APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Dragonfly 2.0|Rancor|Gorgon Group|Ke3chang|Dark Caracal|Leviathan|APT37|APT28|FIN8|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1 +T1059.003,Windows Command Shell,Execution,TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1 T1059.002,AppleScript,Execution,no -T1059.001,PowerShell,Execution,Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|APT28|Thrip|Cobalt Group|Turla|APT19|Dragonfly 2.0|Gorgon Group|DarkHydrus|Leviathan|TA459|MuddyWater|FIN8|OilRig|Magic Hound|BRONZE BUTLER|CopyKittens|APT32|FIN10|menuPass|Threat Group-3390|FIN7|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda -T1567,Exfiltration Over Web Service,Exfiltration,APT28 +T1059.001,PowerShell,Execution,Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda +T1567,Exfiltration Over Web Service,Exfiltration,no T1497.003,Time Based Evasion,Defense Evasion|Discovery,no -T1497.002,User Activity Based Checks,Defense Evasion|Discovery,Darkhotel|FIN7 -T1497.001,System Checks,Defense Evasion|Discovery,Darkhotel|Evilnum|Frankenstein +T1497.002,User Activity Based Checks,Defense Evasion|Discovery,FIN7 +T1497.001,System Checks,Defense Evasion|Discovery,Frankenstein T1498.002,Reflection Amplification,Impact,no T1498.001,Direct Network Flood,Impact,no -T1566.003,Spearphishing via Service,Initial Access,Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal -T1566.002,Spearphishing Link,Initial Access,Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT29|APT33|Leviathan|FIN8|Elderwood|Patchwork|Magic Hound -T1566.001,Spearphishing Attachment,Initial Access,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|OilRig|BRONZE BUTLER|Cobalt Group|FIN7|APT19|Gorgon Group|Rancor|APT32|DarkHydrus|Lazarus Group|Dragonfly 2.0|MuddyWater|APT28|FIN8|Elderwood|APT37|menuPass|TA459|PLATINUM|APT29|Leviathan|Patchwork -T1566,Phishing,Initial Access,GOLD SOUTHFIELD|Dragonfly +T1566.003,Spearphishing via Service,Initial Access,Magic Hound|Windshift|FIN6|OilRig|Dark Caracal +T1566.002,Spearphishing Link,Initial Access,Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8 +T1566.001,Spearphishing Attachment,Initial Access,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass +T1566,Phishing,Initial Access,no T1565.003,Runtime Data Manipulation,Impact,APT38 T1565.002,Transmitted Data Manipulation,Impact,APT38 T1565.001,Stored Data Manipulation,Impact,FIN4|APT38 T1565,Data Manipulation,Impact,no -T1564.001,Hidden Files and Directories,Defense Evasion,Mustang Panda|Rocke|APT32|Tropic Trooper|APT28|Lazarus Group +T1564.001,Hidden Files and Directories,Defense Evasion,Rocke|APT32|Tropic Trooper|APT28|Lazarus Group T1564,Hide Artifacts,Defense Evasion,no T1563.002,RDP Hijacking,Lateral Movement,no T1563.001,SSH Hijacking,Lateral Movement,no T1563,Remote Service Session Hijacking,Lateral Movement,no -T1518.001,Security Software Discovery,Discovery,Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon +T1518.001,Security Software Discovery,Discovery,Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon T1069.003,Cloud Groups,Discovery,no -T1069.002,Domain Groups,Discovery,Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang +T1069.002,Domain Groups,Discovery,Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang T1087.004,Cloud Account,Discovery,no T1087.003,Email Account,Discovery,Sandworm Team|TA505 -T1087.002,Domain Account,Discovery,MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang -T1087.001,Local Account,Discovery,Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 +T1087.002,Domain Account,Discovery,Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang +T1087.001,Local Account,Discovery,Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 T1553.004,Install Root Certificate,Defense Evasion,no -T1562.004,Disable or Modify System Firewall,Defense Evasion,APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak -T1562.003,Impair Command History Logging,Defense Evasion,no -T1562.002,Disable Windows Event Logging,Defense Evasion,APT29|UNC2452|Threat Group-3390 -T1562.001,Disable or Modify Tools,Defense Evasion,APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda +T1562.004,Disable or Modify System Firewall,Defense Evasion,Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak +T1562.003,HISTCONTROL,Defense Evasion,no +T1562.002,Disable Windows Event Logging,Defense Evasion,Threat Group-3390 +T1562.001,Disable or Modify Tools,Defense Evasion,Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda T1562,Impair Defenses,Defense Evasion,no T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390 T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33 T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37 T1561.001,Disk Content Wipe,Impact,Lazarus Group T1561,Disk Wipe,Impact,no -T1560.003,Archive via Custom Method,Collection,Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6 +T1560.003,Archive via Custom Method,Collection,Lazarus Group|Kimsuky|CopyKittens|FIN6 T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390 -T1560.001,Archive via Utility,Collection,APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang +T1560.001,Archive via Utility,Collection,APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang T1560,Archive Collected Data,Collection,menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang T1499.004,Application or System Exploitation,Impact,no T1499.003,Application Exhaustion Flood,Impact,no T1499.002,Service Exhaustion Flood,Impact,no T1499.001,OS Exhaustion Flood,Impact,no -T1491.002,External Defacement,Impact,Sandworm Team +T1491.002,External Defacement,Impact,no T1491.001,Internal Defacement,Impact,Lazarus Group -T1114.003,Email Forwarding Rule,Collection,Silent Librarian|Kimsuky -T1114.002,Remote Email Collection,Collection,APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang -T1114.001,Local Email Collection,Collection,Chimera|Magic Hound|APT1 +T1114.003,Email Forwarding Rule,Collection,no +T1114.002,Remote Email Collection,Collection,APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer +T1114.001,Local Email Collection,Collection,Magic Hound|APT1 T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no T1134.003,Make and Impersonate Token,Defense Evasion|Privilege Escalation,no T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|Lazarus Group T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,APT28 -T1213.002,Sharepoint,Collection,Chimera|Ke3chang|APT28 +T1213.002,Sharepoint,Collection,Ke3chang|APT28 T1213.001,Confluence,Collection,no -T1555.003,Credentials from Web Browsers,Credential Access,Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats +T1555.003,Credentials from Web Browsers,Credential Access,Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats T1555.002,Securityd Memory,Credential Access,no T1555.001,Keychain,Credential Access,no -T1559.002,Dynamic Data Exchange,Execution,Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Cobalt Group|Patchwork|APT37|APT28|FIN7 +T1559.002,Dynamic Data Exchange,Execution,Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7 T1559.001,Component Object Model,Execution,Gamaredon Group|MuddyWater T1559,Inter-Process Communication,Execution,no T1558.002,Silver Ticket,Credential Access,no T1558.001,Golden Ticket,Credential Access,Ke3chang T1558,Steal or Forge Kerberos Tickets,Credential Access,no -T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Wizard Spider -T1557,Man-in-the-Middle,Credential Access|Collection,Kimsuky -T1556.002,Password Filter DLL,Credential Access|Defense Evasion|Persistence,Strider -T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion|Persistence,Chimera -T1556,Modify Authentication Process,Credential Access|Defense Evasion|Persistence,no +T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,no +T1557,Man-in-the-Middle,Credential Access|Collection,no +T1556.002,Password Filter DLL,Credential Access|Defense Evasion,Strider +T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion,no +T1556,Modify Authentication Process,Credential Access|Defense Evasion,no T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM T1056.003,Web Portal Capture,Collection|Credential Access,no T1056.002,GUI Input Capture,Collection|Credential Access,FIN4 -T1056.001,Keylogging,Collection|Credential Access,Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 -T1555,Credentials from Password Stores,Credential Access,APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon +T1056.001,Keylogging,Collection|Credential Access,APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 +T1555,Credentials from Password Stores,Credential Access,APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon T1552.005,Cloud Instance Metadata API,Credential Access,no T1003.008,/etc/passwd and /etc/shadow,Credential Access,no T1003.007,Proc Filesystem,Credential Access,no -T1003.006,DCSync,Credential Access,APT29|UNC2452|Operation Wocao -T1558.003,Kerberoasting,Credential Access,APT29|UNC2452|Operation Wocao|Wizard Spider +T1003.006,DCSync,Credential Access,no +T1558.003,Kerberoasting,Credential Access,no T1552.006,Group Policy Preferences,Credential Access,APT33 -T1003.003,NTDS,Credential Access,Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0 -T1003.002,Security Account Manager,Credential Access,Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass -T1003.001,LSASS Memory,Credential Access,HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|PLATINUM|FIN8|MuddyWater|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver -T1110.004,Credential Stuffing,Credential Access,Chimera -T1110.003,Password Spraying,Credential Access,Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group -T1110.002,Password Cracking,Credential Access,FIN6|APT41|Dragonfly 2.0|APT3 -T1110.001,Password Guessing,Credential Access,APT28 -T1021.006,Windows Remote Management,Lateral Movement,APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390 -T1021.005,VNC,Lateral Movement,Fox Kitten|GCMAN -T1021.004,SSH,Lateral Movement,Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN +T1003.003,NTDS,Credential Access,FIN6|Dragonfly 2.0 +T1003.002,Security Account Manager,Credential Access,Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass +T1003.001,LSASS Memory,Credential Access,Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver +T1110.004,Credential Stuffing,Credential Access,no +T1110.003,Password Spraying,Credential Access,APT33|Leafminer|Lazarus Group +T1110.002,Password Cracking,Credential Access,APT41|Dragonfly 2.0|APT3 +T1110.001,Password Guessing,Credential Access,no +T1021.006,Windows Remote Management,Lateral Movement,Threat Group-3390 +T1021.005,VNC,Lateral Movement,GCMAN +T1021.004,SSH,Lateral Movement,Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN T1021.003,Distributed Component Object Model,Lateral Movement,no -T1021.002,SMB/Windows Admin Shares,Lateral Movement,Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang -T1021.001,Remote Desktop Protocol,Lateral Movement,Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom +T1021.002,SMB/Windows Admin Shares,Lateral Movement,Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang +T1021.001,Remote Desktop Protocol,Lateral Movement,Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom T1554,Compromise Client Software Binary,Persistence,no T1036.006,Space after Filename,Defense Evasion,no -T1036.005,Match Legitimate Name or Location,Defense Evasion,APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 -T1036.004,Masquerade Task or Service,Defense Evasion,ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 -T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|GALLIUM +T1036.005,Match Legitimate Name or Location,Defense Evasion,Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 +T1036.004,Masquerade Task or Service,Defense Evasion,Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 +T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|Soft Cell|PLATINUM T1036.002,Right-to-Left Override,Defense Evasion,BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic -T1036.001,Invalid Code Signature,Defense Evasion,Windshift|APT37 +T1036.001,Invalid Code Signature,Defense Evasion,Windshift T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no -T1553.002,Code Signing,Defense Evasion,APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel +T1553.002,Code Signing,Defense Evasion,Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel T1553.001,Gatekeeper Bypass,Defense Evasion,no T1553,Subvert Trust Controls,Defense Evasion,no -T1027.003,Steganography,Defense Evasion,TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 -T1027.002,Software Packing,Defense Evasion,ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon -T1027.001,Binary Padding,Defense Evasion,Mustang Panda|Higaisa|Gamaredon Group|APT32|Patchwork|Leviathan|BRONZE BUTLER|Moafee +T1027.003,Steganography,Defense Evasion,BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 +T1027.002,Software Packing,Defense Evasion,TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon +T1027.001,Binary Padding,Defense Evasion,Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,Rocke|APT32 -T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,Wizard Spider -T1552.004,Private Keys,Credential Access,APT29|UNC2452|Operation Wocao|Rocke +T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,no +T1552.004,Private Keys,Credential Access,Rocke T1552.003,Bash History,Credential Access,no T1552.002,Credentials in Registry,Credential Access,APT32 -T1552.001,Credentials In Files,Credential Access,Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 +T1552.001,Credentials In Files,Credential Access,Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 T1552,Unsecured Credentials,Credential Access,no T1216.001,PubPrn,Defense Evasion,APT32 -T1070.006,Timestomp,Defense Evasion,APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 +T1070.006,Timestomp,Defense Evasion,Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390 -T1070.004,File Deletion,Defense Evasion,APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Honeybee|Patchwork|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|FIN5|BRONZE BUTLER|OilRig|APT3|Magic Hound|APT28|FIN10|Threat Group-3390|Group5|Lazarus Group|APT18|APT29 +T1070.004,File Deletion,Defense Evasion,Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29 T1070.003,Clear Command History,Defense Evasion,APT41 -T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,APT29|UNC2452 +T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,no T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28 T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29 -T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1 -T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,APT29|UNC2452 +T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1 +T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,no T1548.004,Elevated Execution with Prompt,Privilege Escalation|Defense Evasion,no T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no -T1548.002,Bypass User Account Control,Privilege Escalation|Defense Evasion,Evilnum|APT37|MuddyWater|Cobalt Group|Honeybee|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29 +T1548.002,Bypass User Access Control,Privilege Escalation|Defense Evasion,APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29 T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no T1136.003,Cloud Account,Persistence,no T1070.002,Clear Linux or Mac System Logs,Defense Evasion,Rocke -T1070.001,Clear Windows Event Logs,Defense Evasion,Chimera|Operation Wocao|APT41|APT38|APT32|Dragonfly 2.0|FIN8|FIN5|APT28 -T1136.002,Domain Account,Persistence,HAFNIUM|GALLIUM -T1136.001,Local Account,Persistence,Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3 +T1070.001,Clear Windows Event Logs,Defense Evasion,APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 +T1136.002,Domain Account,Persistence,Soft Cell +T1136.001,Local Account,Persistence,APT39|APT41|Dragonfly 2.0|Leafminer|APT3 T1547.011,Plist Modification,Persistence|Privilege Escalation,no T1547.010,Port Monitors,Persistence|Privilege Escalation,no T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group T1547.008,LSASS Driver,Persistence|Privilege Escalation,no T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no -T1547.005,Security Support Provider,Persistence|Privilege Escalation,Lazarus Group -T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Wizard Spider|Tropic Trooper|Turla +T1547.005,Security Support Provider,Persistence|Privilege Escalation,no +T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Tropic Trooper|Turla T1547.003,Time Providers,Persistence|Privilege Escalation,no T1546.014,Emond,Privilege Escalation|Persistence,no T1546.013,PowerShell Profile,Privilege Escalation|Persistence,Turla @@ -359,38 +236,38 @@ T1546.012,Image File Execution Options Injection,Privilege Escalation|Persistenc T1218.008,Odbcconf,Defense Evasion,Cobalt Group T1546.011,Application Shimming,Privilege Escalation|Persistence,FIN7 T1547.002,Authentication Package,Persistence|Privilege Escalation,no -T1546.010,AppInit DLLs,Privilege Escalation|Persistence,APT39 +T1546.010,AppInit DLLs,Privilege Escalation|Persistence,no T1546.009,AppCert DLLs,Privilege Escalation|Persistence,Honeybee -T1218.007,Msiexec,Defense Evasion,ZIRCONIUM|Molerats|Machete|TA505|Rancor -T1546.008,Accessibility Features,Privilege Escalation|Persistence,Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom +T1218.007,Msiexec,Defense Evasion,TA505|Rancor +T1546.008,Accessibility Features,Privilege Escalation|Persistence,APT41|APT3|APT29|Deep Panda|Axiom T1546.007,Netsh Helper DLL,Privilege Escalation|Persistence,no T1546.006,LC_LOAD_DYLIB Addition,Privilege Escalation|Persistence,no T1546.005,Trap,Privilege Escalation|Persistence,no -T1546.004,Unix Shell Configuration Modification,Privilege Escalation|Persistence,no -T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29 +T1546.004,.bash_profile and .bashrc,Privilege Escalation|Persistence,no +T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,APT33|Blue Mockingbird|Turla|Leviathan|APT29 T1546.002,Screensaver,Privilege Escalation|Persistence,no T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky -T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Threat Group-3390|Turla|Honeybee|APT19|Cobalt Group|Ke3chang|Dragonfly 2.0|Gorgon Group|Leviathan|APT37|MuddyWater|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel +T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel T1218.002,Control Panel,Defense Evasion,no -T1218.010,Regsvr32,Defense Evasion,TA551|Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda +T1218.010,Regsvr32,Defense Evasion,Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda T1218.009,Regsvcs/Regasm,Defense Evasion,no -T1218.005,Mshta,Defense Evasion,Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7 -T1218.004,InstallUtil,Defense Evasion,Mustang Panda|menuPass -T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|OilRig|Dark Caracal +T1218.005,Mshta,Defense Evasion,Inception|Kimsuky|APT32|MuddyWater|FIN7 +T1218.004,InstallUtil,Defense Evasion,no +T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|Dark Caracal|OilRig T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater -T1218.011,Rundll32,Defense Evasion,HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 +T1218.011,Rundll32,Defense Evasion,APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no T1546,Event Triggered Execution,Privilege Escalation|Persistence,no T1098.003,Add Office 365 Global Administrator Role,Persistence,no -T1098.002,Exchange Email Delegate Permissions,Persistence,APT29|UNC2452|Magic Hound -T1098.001,Additional Cloud Credentials,Persistence,APT29|UNC2452 +T1098.002,Exchange Email Delegate Permissions,Persistence,Magic Hound +T1098.001,Additional Azure Service Principal Credentials,Persistence,no T1543.004,Launch Daemon,Persistence|Privilege Escalation,no -T1543.003,Windows Service,Persistence|Privilege Escalation,PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Threat Group-3390|Honeybee|APT3|Lazarus Group|Carbanak +T1543.003,Windows Service,Persistence|Privilege Escalation,Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak T1543.002,Systemd Service,Persistence|Privilege Escalation,Rocke T1543.001,Launch Agent,Persistence|Privilege Escalation,no T1037.005,Startup Items,Persistence|Privilege Escalation,no -T1037.004,RC Scripts,Persistence|Privilege Escalation,no -T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Gorgon Group|Threat Group-3390|menuPass|Patchwork +T1037.004,Rc.common,Persistence|Privilege Escalation,no +T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no @@ -400,7 +277,7 @@ T1055.005,Thread Local Storage,Defense Evasion|Privilege Escalation,no T1055.004,Asynchronous Procedure Call,Defense Evasion|Privilege Escalation,no T1055.003,Thread Execution Hijacking,Defense Evasion|Privilege Escalation,no T1055.002,Portable Executable Injection,Defense Evasion|Privilege Escalation,Rocke|Gorgon Group -T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda +T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda T1037.003,Network Logon Script,Persistence|Privilege Escalation,no T1543,Create or Modify System Process,Persistence|Privilege Escalation,no T1037.002,Logon Script (Mac),Persistence|Privilege Escalation,no @@ -408,13 +285,13 @@ T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|A T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28 T1542.002,Component Firmware,Persistence|Defense Evasion,Equation T1542.001,System Firmware,Persistence|Defense Evasion,no -T1505.003,Web Shell,Persistence,Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda +T1505.003,Web Shell,Persistence,Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda T1505.002,Transport Agent,Persistence,no T1505.001,SQL Stored Procedures,Persistence,no T1053.003,Cron,Execution|Persistence|Privilege Escalation,Rocke T1053.004,Launchd,Execution|Persistence|Privilege Escalation,no T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no -T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Rancor|Cobalt Group|OilRig|Patchwork|FIN8|FIN7|menuPass|FIN10|APT32|Stealth Falcon|FIN6|APT3|APT29 +T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29 T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18 T1542,Pre-OS Boot,Defense Evasion|Persistence,no T1137.001,Office Template Macros,Persistence,MuddyWater @@ -424,141 +301,140 @@ T1137.005,Outlook Rules,Persistence,no T1137.006,Add-ins,Persistence,Naikon T1137.002,Office Test,Persistence,APT28 T1531,Account Access Removal,Impact,no -T1539,Steal Web Session Cookie,Credential Access,Evilnum +T1539,Steal Web Session Cookie,Credential Access,no T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37 -T1518,Software Discovery,Discovery,Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception -T1547.013,XDG Autostart Entries,Persistence|Privilege Escalation,no +T1518,Software Discovery,Discovery,BRONZE BUTLER|Tropic Trooper|Inception T1534,Internal Spearphishing,Lateral Movement,Gamaredon Group T1528,Steal Application Access Token,Credential Access,APT28 T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no -T1525,Implant Internal Image,Persistence,no +T1525,Implant Container Image,Persistence,no T1538,Cloud Service Dashboard,Discovery,no -T1530,Data from Cloud Storage Object,Collection,Fox Kitten +T1530,Data from Cloud Storage Object,Collection,no T1578,Modify Cloud Compute Infrastructure,Defense Evasion,no T1537,Transfer Data to Cloud Account,Exfiltration,no T1526,Cloud Service Discovery,Discovery,no T1505,Server Software Component,Persistence,no -T1499,Endpoint Denial of Service,Impact,Sandworm Team -T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,Darkhotel -T1498,Network Denial of Service,Impact,APT28 +T1499,Endpoint Denial of Service,Impact,no +T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,no +T1498,Network Denial of Service,Impact,no T1496,Resource Hijacking,Impact,Blue Mockingbird|Rocke|APT41|Lazarus Group T1495,Firmware Corruption,Impact,no T1491,Defacement,Impact,no T1490,Inhibit System Recovery,Impact,no -T1489,Service Stop,Impact,Wizard Spider|Lazarus Group -T1486,Data Encrypted for Impact,Impact,Indrik Spider|APT41|TA505|APT38 +T1489,Service Stop,Impact,Lazarus Group +T1486,Data Encrypted for Impact,Impact,APT41|TA505|APT38 T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38 -T1484,Domain Policy Modification,Defense Evasion|Privilege Escalation,no -T1482,Domain Trust Discovery,Discovery,APT29|Chimera|UNC2452 +T1484,Group Policy Modification,Defense Evasion|Privilege Escalation,no +T1482,Domain Trust Discovery,Discovery,Wizard Spider T1480,Execution Guardrails,Defense Evasion,no -T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus -T1220,XSL Script Processing,Defense Evasion,Higaisa|Cobalt Group T1222,File and Directory Permissions Modification,Defense Evasion,no -T1189,Drive-by Compromise,Initial Access,Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Lazarus Group|BRONZE BUTLER|Threat Group-3390|Dragonfly 2.0|APT32|Leafminer|APT19|Dark Caracal|Elderwood|Patchwork|PLATINUM|APT37 -T1207,Rogue Domain Controller,Defense Evasion,no -T1199,Trusted Relationship,Initial Access,Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass -T1197,BITS Jobs,Defense Evasion|Persistence,APT39|Patchwork|APT41|Leviathan -T1217,Browser Bookmark Discovery,Discovery,Chimera|Fox Kitten -T1213,Data from Information Repositories,Collection,Fox Kitten|FIN6|Turla +T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus +T1220,XSL Script Processing,Defense Evasion,Cobalt Group +T1197,BITS Jobs,Defense Evasion|Persistence,Patchwork|APT41|Leviathan +T1217,Browser Bookmark Discovery,Discovery,no +T1213,Data from Information Repositories,Collection,Turla +T1189,Drive-by Compromise,Initial Access,Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM +T1203,Exploitation for Client Execution,Execution,Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29 T1212,Exploitation for Credential Access,Credential Access,no T1211,Exploitation for Defense Evasion,Defense Evasion,APT28 -T1200,Hardware Additions,Initial Access,DarkVishnya +T1190,Exploit Public-Facing Application,Initial Access,Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom +T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28 T1202,Indirect Command Execution,Defense Evasion,no -T1201,Password Policy Discovery,Discovery,Chimera|Turla|OilRig -T1190,Exploit Public-Facing Application,Initial Access,Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom -T1210,Exploitation of Remote Services,Lateral Movement,Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28 -T1219,Remote Access Software,Command And Control,Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak -T1195,Supply Chain Compromise,Initial Access,no -T1204,User Execution,Execution,no -T1203,Exploitation for Client Execution,Execution,Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Cobalt Group|Lazarus Group|APT29|TA459|APT37|Leviathan|Patchwork|Elderwood +T1200,Hardware Additions,Initial Access,DarkVishnya +T1201,Password Policy Discovery,Discovery,Turla|OilRig +T1219,Remote Access Software,Command And Control,Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak +T1207,Rogue Domain Controller,Defense Evasion,no +T1199,Trusted Relationship,Initial Access,APT28|menuPass T1218,Signed Binary Proxy Execution,Defense Evasion,no -T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no +T1204,User Execution,Execution,no T1216,Signed Script Proxy Execution,Defense Evasion,no +T1195,Supply Chain Compromise,Initial Access,Elderwood +T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,no -T1187,Forced Authentication,Credential Access,Dragonfly 2.0|DarkHydrus +T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0 T1185,Man in the Browser,Collection,no -T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,FIN6|Blue Mockingbird +T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Blue Mockingbird T1136,Create Account,Persistence,no +T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER T1149,LC_MAIN Hijacking,Defense Evasion,no +T1135,Network Share Discovery,Discovery,APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug T1137,Office Application Startup,Persistence,Gamaredon Group|APT32 -T1140,Deobfuscate/Decode Files or Information,Defense Evasion,APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Threat Group-3390|menuPass|Gorgon Group|Honeybee|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER -T1135,Network Share Discovery,Discovery,Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug T1153,Source,Execution,no -T1133,External Remote Services,Persistence|Initial Access,APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18 +T1133,External Remote Services,Persistence|Initial Access,Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18 T1132,Data Encoding,Command And Control,no T1129,Shared Modules,Execution,no T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no T1125,Video Capture,Collection,Silence|FIN7 -T1124,System Time Discovery,Discovery,Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla +T1124,System Time Discovery,Discovery,The White Company|Lazarus Group|BRONZE BUTLER|Turla T1123,Audio Capture,Collection,APT37 -T1120,Peripheral Device Discovery,Discovery,Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28 -T1119,Automated Collection,Collection,Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 -T1115,Clipboard Data,Collection,Operation Wocao|APT39|APT38 -T1114,Email Collection,Collection,Silent Librarian -T1113,Screen Capture,Collection,GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 -T1112,Modify Registry,Defense Evasion,Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Patchwork|Gorgon Group|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|FIN8 -T1111,Two-Factor Authentication Interception,Credential Access,Chimera|Operation Wocao -T1110,Brute Force,Credential Access,APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla +T1120,Peripheral Device Discovery,Discovery,Turla|APT37|Gamaredon Group|Equation|APT28 +T1119,Automated Collection,Collection,Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 +T1115,Clipboard Data,Collection,APT39|APT38 +T1114,Email Collection,Collection,no +T1113,Screen Capture,Collection,Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 +T1112,Modify Registry,Defense Evasion,Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8 +T1111,Two-Factor Authentication Interception,Credential Access,no +T1110,Brute Force,Credential Access,DarkVishnya|APT39|OilRig|FIN5|Turla T1108,Redundant Access,Defense Evasion|Persistence,no -T1106,Native API,Execution,Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group -T1105,Ingress Tool Transfer,Command And Control,HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Turla|OilRig|Rancor|Cobalt Group|Gorgon Group|Dragonfly 2.0|APT37|Elderwood|Leviathan|FIN8|PLATINUM|Magic Hound|BRONZE BUTLER|APT3|APT32|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 +T1106,Native API,Execution,Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37 +T1105,Ingress Tool Transfer,Command And Control,Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3 -T1102,Web Service,Command And Control,Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6 +T1102,Web Service,Command And Control,Gamaredon Group|Rocke|Inception|FIN6 T1098,Account Manipulation,Persistence,APT3|Dragonfly 2.0|Lazarus Group -T1095,Non-Application Layer Protocol,Command And Control,HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3 +T1095,Non-Application Layer Protocol,Command And Control,APT29|PLATINUM|APT3 T1092,Communication Through Removable Media,Command And Control,APT28 -T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Mustang Panda|Tropic Trooper|Darkhotel|APT28 -T1090,Proxy,Command And Control,Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla -T1087,Account Discovery,Discovery,APT29|UNC2452 -T1083,File and Directory Discovery,Discovery,APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dragonfly 2.0|Dark Caracal|Sowbug|APT3|Magic Hound|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang -T1082,System Information Discovery,Discovery,APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT32|APT37|Honeybee|APT19|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang -T1080,Taint Shared Content,Lateral Movement,Gamaredon Group|BRONZE BUTLER|Darkhotel -T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|APT33|Leviathan|FIN8|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak +T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Tropic Trooper|Darkhotel|APT28 +T1090,Proxy,Command And Control,Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla +T1087,Account Discovery,Discovery,no +T1083,File and Directory Discovery,Discovery,Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang +T1082,System Information Discovery,Discovery,Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang +T1080,Taint Shared Content,Lateral Movement,BRONZE BUTLER|Darkhotel +T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak T1074,Data Staged,Collection,Wizard Spider T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314 T1071,Application Layer Protocol,Command And Control,Rocke|Magic Hound|Dragonfly 2.0 -T1070,Indicator Removal on Host,Defense Evasion,APT29|UNC2452 -T1069,Permission Groups Discovery,Discovery,APT29|UNC2452|TA505|APT3 -T1068,Exploitation for Privilege Escalation,Privilege Escalation,ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 +T1070,Indicator Removal on Host,Defense Evasion,no +T1069,Permission Groups Discovery,Discovery,TA505|APT3 +T1068,Exploitation for Privilege Escalation,Privilege Escalation,Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 T1064,Scripting,Defense Evasion|Execution,no T1062,Hypervisor,Persistence,no T1061,Graphical User Interface,Execution,no -T1059,Command and Scripting Interpreter,Execution,Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang -T1057,Process Discovery,Discovery,APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang -T1056,Input Capture,Collection|Credential Access,APT39 -T1055,Process Injection,Defense Evasion|Privilege Escalation,Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|APT37|Cobalt Group|Turla|Honeybee|PLATINUM +T1059,Command and Scripting Interpreter,Execution,APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang +T1057,Process Discovery,Discovery,Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang +T1056,Input Capture,Collection|Credential Access,no +T1055,Process Injection,Defense Evasion|Privilege Escalation,APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no T1052,Exfiltration Over Physical Medium,Exfiltration,no T1051,Shared Webroot,Lateral Movement,no -T1049,System Network Connections Discovery,Discovery,Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang +T1049,System Network Connections Discovery,Discovery,Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang T1048,Exfiltration Over Alternative Protocol,Exfiltration,no -T1047,Windows Management Instrumentation,Execution,Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|Threat Group-3390|OilRig|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda -T1046,Network Service Scanning,Discovery,Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Cobalt Group|OilRig|Leafminer|menuPass|Suckfly|FIN6|Threat Group-3390 -T1043,Commonly Used Port,Command And Control,OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|APT3|Magic Hound|Lazarus Group|Threat Group-3390 -T1041,Exfiltration Over C2 Channel,Exfiltration,ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang -T1040,Network Sniffing,Credential Access|Discovery,Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 -T1039,Data from Network Shared Drive,Collection,Chimera|Fox Kitten|Gamaredon Group|BRONZE BUTLER|Sowbug|menuPass +T1047,Windows Management Instrumentation,Execution,Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda +T1046,Network Service Scanning,Discovery,Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390 +T1043,Commonly Used Port,Command And Control,Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390 +T1041,Exfiltration Over C2 Channel,Exfiltration,Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang +T1040,Network Sniffing,Credential Access|Discovery,Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 +T1039,Data from Network Shared Drive,Collection,Sowbug|BRONZE BUTLER|menuPass T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke -T1036,Masquerading,Defense Evasion,APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0 +T1036,Masquerading,Defense Evasion,Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0 T1034,Path Interception,Persistence|Privilege Escalation,no -T1033,System Owner/User Discovery,Discovery,Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|Dragonfly 2.0|APT37|APT19|APT32|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 +T1033,System Owner/User Discovery,Discovery,Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390 -T1029,Scheduled Transfer,Exfiltration,Higaisa -T1027,Obfuscated Files or Information,Defense Evasion,APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|APT37|Honeybee|Dark Caracal|Leafminer|menuPass|Threat Group-3390|APT19|BlackOasis|FIN8|FIN7|Elderwood|MuddyWater|Leviathan|Magic Hound|OilRig|APT3|APT32|Group5|Lazarus Group|Dust Storm|Putter Panda|APT28 +T1029,Scheduled Transfer,Exfiltration,no +T1027,Obfuscated Files or Information,Defense Evasion,Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 T1026,Multiband Communication,Command And Control,Lazarus Group -T1025,Data from Removable Media,Collection,Turla|Gamaredon Group|APT28 +T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28 T1021,Remote Services,Lateral Movement,no -T1020,Automated Exfiltration,Exfiltration,Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee -T1018,Remote System Discovery,Discovery,APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Deep Panda|Dragonfly 2.0|Threat Group-3390|Leafminer|Ke3chang|FIN8|BRONZE BUTLER|FIN5|APT3|menuPass|FIN6|Turla -T1016,System Network Configuration Discovery,Discovery,ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang +T1020,Automated Exfiltration,Exfiltration,Tropic Trooper|Frankenstein|Honeybee +T1018,Remote System Discovery,Discovery,Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla +T1016,System Network Configuration Discovery,Discovery,Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang T1014,Rootkit,Defense Evasion,Rocke|APT41|APT28|Winnti Group -T1012,Query Registry,Discovery,ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Threat Group-3390|Dragonfly 2.0|OilRig|Stealth Falcon|Lazarus Group|Turla +T1012,Query Registry,Discovery,APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla T1011,Exfiltration Over Other Network Medium,Exfiltration,no T1010,Application Window Discovery,Discovery,Lazarus Group -T1008,Fallback Channels,Command And Control,Carbanak|APT41|OilRig|Lazarus Group -T1007,System Service Discovery,Discovery,Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang +T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group +T1007,System Service Discovery,Discovery,BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang T1006,Direct Volume Access,Defense Evasion,no -T1005,Data from Local System,Collection,APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|BRONZE BUTLER|APT3|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang +T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom -T1001,Data Obfuscation,Command And Control,Operation Wocao|Axiom +T1001,Data Obfuscation,Command And Control,Axiom diff --git a/dist/saaws/app.manifest b/dist/saaws/app.manifest index 5aea5a9054..66fc96e7dc 100644 --- a/dist/saaws/app.manifest +++ b/dist/saaws/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS_AmazonWebServices_Content", - "version": "3.20.0" + "version": "3.21.0" }, "author": [ { diff --git a/dist/saaws/default/analytic_stories.conf b/dist/saaws/default/analytic_stories.conf index ffaaf124f2..7e88480951 100644 --- a/dist/saaws/default/analytic_stories.conf +++ b/dist/saaws/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-04-29T21:11:03 UTC +# On Date: 2021-05-13T21:47:01 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -34,7 +34,7 @@ version = 2 reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] detection_searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule"] mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.AE", "DE.DP"]} -investigative_searches = ["ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task"] +investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -51,7 +51,7 @@ version = 1 reference = ["https://aws.amazon.com/security-hub/features/"] detection_searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule"] mappings = {"cis20": ["CIS 13"], "nist": ["DE.AE", "DE.DP"]} -investigative_searches = ["ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] +investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -68,8 +68,8 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} -investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] -support_searches = ["ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Regions - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Creations By User - Update"] +investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Previously Seen Cloud Regions - Update"] data_models = ["Change"] providing_technologies = none description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. @@ -156,7 +156,7 @@ version = 2 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] detection_searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule"] mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "PR.AC", "PR.DS"]} -investigative_searches = ["ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task"] +investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -176,7 +176,7 @@ reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cr detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"] mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.AE", "DE.DP", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - Investigate AWS User Activities by user field - Response Task"] -support_searches = ["ESCU - Previously Seen Users in CloudTrail - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen Users In CloudTrail - Update", "ESCU - Previously Seen AWS Cross Account Activity - Update"] +support_searches = ["ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users In CloudTrail - Update", "ESCU - Previously Seen Users in CloudTrail - Initial"] data_models = ["Authentication"] providing_technologies = none description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. @@ -193,8 +193,8 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule"] mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} -investigative_searches = ["ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] -support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Previously Seen Cloud Instance Modifications By User - Update", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial"] +investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"] data_models = ["Change"] providing_technologies = none description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. @@ -229,7 +229,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p detection_searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"] mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "mitre_attack": ["T1078", "T1078.004", "T1580"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"] -support_searches = ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Update", "ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Baseline Of Cloud Security Group API Calls Per User"] +support_searches = ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User", "ESCU - Baseline Of Cloud Security Group API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Previously Seen Cloud API Calls Per User Role - Update"] data_models = ["Change"] providing_technologies = none description = Detect and investigate suspicious activities by users and roles in your cloud environments. diff --git a/dist/saaws/default/analyticstories.conf b/dist/saaws/default/analyticstories.conf index 3595c563de..d6586bc473 100644 --- a/dist/saaws/default/analyticstories.conf +++ b/dist/saaws/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-04-29T21:11:03 UTC +# On Date: 2021-05-13T21:47:01 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14,7 +14,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", "https://www.cyberark.com/resources/threat-research-blog/the-cloud-shadow-admin-threat-10-permissions-to-protect", "https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS UpdateLoginProfile - Rule", "ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule"] +searches = ["ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS UpdateLoginProfile - Rule"] description = This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation. narrative = Amazon Web Services provides a neat feature called Identity and Access Management (IAM) that enables organizations to manage various AWS services and resources in a secure way. All IAM users have roles, groups and policies associated with them which governs and sets permissions to allow a user to access specific restrictions.\ However, if these IAM policies are misconfigured and have specific combinations of weak permissions; it can allow attackers to escalate their privileges and further compromise the organization. Rhino Security Labs have published comprehensive blogs detailing various AWS Escalation methods. By using this as an inspiration, Splunk’s research team wants to highlight how these attack vectors look in AWS Cloudtrail logs and provide you with detection queries to uncover these potentially malicious events via this Analytic Story. \ @@ -26,7 +26,7 @@ version = 2 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task"] +searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -37,7 +37,7 @@ version = 1 references = ["https://aws.amazon.com/security-hub/features/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] +searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] description = This story is focused around detecting Security Hub alerts generated from AWS narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager. @@ -48,7 +48,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -62,7 +62,7 @@ version = 1 references = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - AWS SAML Access by Provider User and Principal - Rule"] +searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule"] description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements. narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches. @@ -73,7 +73,7 @@ version = 1 references = ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] spec_version = 3 -searches = ["ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule"] +searches = ["ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"] description = This story is focused around detecting Office 365 Attacks. narrative = More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks. @@ -84,7 +84,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"] maintainers = [{"company": "David Dorsey, Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule"] +searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources. @@ -95,7 +95,7 @@ version = 1 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. @@ -106,7 +106,7 @@ version = 2 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task"] +searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ @@ -119,7 +119,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\ This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS. @@ -131,7 +131,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities. @@ -142,7 +142,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule"] +searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -154,7 +154,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Detect and investigate suspicious activities by users and roles in your cloud environments. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage. diff --git a/dist/saaws/default/app.conf b/dist/saaws/default/app.conf index bcd4905027..12d6b3340f 100644 --- a/dist/saaws/default/app.conf +++ b/dist/saaws/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 27601 +build = 28811 [triggers] reload.analytic_stories = simple @@ -18,7 +18,7 @@ reload.content-version = simple [launcher] author = Splunk -version = 3.20.0 +version = 3.21.0 description = Explore the Analytic Stories included with Splunk Security Analytics for AWS Content [ui] diff --git a/dist/saaws/default/collections.conf b/dist/saaws/default/collections.conf index 41c6644e03..9368a21839 100644 --- a/dist/saaws/default/collections.conf +++ b/dist/saaws/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-04-29T21:11:03 UTC +# On Date: 2021-05-13T21:47:01 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/content-version.conf b/dist/saaws/default/content-version.conf index 9880d5c77b..a5773f5ac7 100644 --- a/dist/saaws/default/content-version.conf +++ b/dist/saaws/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.20.0 +version = 3.21.0 diff --git a/dist/saaws/default/es_investigations.conf b/dist/saaws/default/es_investigations.conf index 8efda4e9a2..cbe2fbcb37 100644 --- a/dist/saaws/default/es_investigations.conf +++ b/dist/saaws/default/es_investigations.conf @@ -11,21 +11,21 @@ label = AWS Network ACL Activity description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. disabled = 0 -panels = ["panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task"] +panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task"] [panel_group://workbench_panel_group_aws_security_hub_alerts] label = AWS Security Hub Alerts description = This story is focused around detecting Security Hub alerts generated from AWS disabled = 0 -panels = ["panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task"] +panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task"] [panel_group://workbench_panel_group_cloud_cryptomining] label = Cloud Cryptomining description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. disabled = 0 -panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"] +panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"] [panel_group://workbench_panel_group_cloud_federated_credential_abuse] label = Cloud Federated Credential Abuse @@ -60,7 +60,7 @@ label = Suspicious AWS S3 Activities description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. disabled = 0 -panels = ["panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task"] +panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"] [panel_group://workbench_panel_group_suspicious_cloud_authentication_activities] label = Suspicious Cloud Authentication Activities @@ -74,7 +74,7 @@ label = Suspicious Cloud Instance Activities description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. disabled = 0 -panels = ["panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task"] +panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task"] [panel_group://workbench_panel_group_suspicious_cloud_provisioning_activities] label = Suspicious Cloud Provisioning Activities diff --git a/dist/saaws/default/macros.conf b/dist/saaws/default/macros.conf index 1dee787803..a391772650 100644 --- a/dist/saaws/default/macros.conf +++ b/dist/saaws/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-04-29T21:11:03 UTC +# On Date: 2021-05-13T21:47:01 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -142,6 +142,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet definition = eventtype="osquery-process" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +[powershell] +definition = sourcetype=wineventlog OR source=WinEventLog:Microsoft-Windows-PowerShell/Operational +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + [previously_seen_cloud_api_calls_per_user_role_forget_window] definition = "-90d@d" description = Use this macro to determine how long to keep track of cloud api calls per user role diff --git a/dist/saaws/default/savedsearches.conf b/dist/saaws/default/savedsearches.conf index 42ed0ac1b5..28dba12435 100644 --- a/dist/saaws/default/savedsearches.conf +++ b/dist/saaws/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-04-29T21:11:03 UTC +# On Date: 2021-05-13T21:47:01 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/transforms.conf b/dist/saaws/default/transforms.conf index 795905e1a1..1e8629e4d6 100644 --- a/dist/saaws/default/transforms.conf +++ b/dist/saaws/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-04-29T21:11:03 UTC +# On Date: 2021-05-13T21:47:01 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/use_case_library.conf b/dist/saaws/default/use_case_library.conf index 3595c563de..d6586bc473 100644 --- a/dist/saaws/default/use_case_library.conf +++ b/dist/saaws/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-04-29T21:11:03 UTC +# On Date: 2021-05-13T21:47:01 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14,7 +14,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", "https://www.cyberark.com/resources/threat-research-blog/the-cloud-shadow-admin-threat-10-permissions-to-protect", "https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS UpdateLoginProfile - Rule", "ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule"] +searches = ["ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS UpdateLoginProfile - Rule"] description = This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation. narrative = Amazon Web Services provides a neat feature called Identity and Access Management (IAM) that enables organizations to manage various AWS services and resources in a secure way. All IAM users have roles, groups and policies associated with them which governs and sets permissions to allow a user to access specific restrictions.\ However, if these IAM policies are misconfigured and have specific combinations of weak permissions; it can allow attackers to escalate their privileges and further compromise the organization. Rhino Security Labs have published comprehensive blogs detailing various AWS Escalation methods. By using this as an inspiration, Splunk’s research team wants to highlight how these attack vectors look in AWS Cloudtrail logs and provide you with detection queries to uncover these potentially malicious events via this Analytic Story. \ @@ -26,7 +26,7 @@ version = 2 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task"] +searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -37,7 +37,7 @@ version = 1 references = ["https://aws.amazon.com/security-hub/features/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] +searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] description = This story is focused around detecting Security Hub alerts generated from AWS narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager. @@ -48,7 +48,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -62,7 +62,7 @@ version = 1 references = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - AWS SAML Access by Provider User and Principal - Rule"] +searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule"] description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements. narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches. @@ -73,7 +73,7 @@ version = 1 references = ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] spec_version = 3 -searches = ["ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule"] +searches = ["ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"] description = This story is focused around detecting Office 365 Attacks. narrative = More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks. @@ -84,7 +84,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"] maintainers = [{"company": "David Dorsey, Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule"] +searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources. @@ -95,7 +95,7 @@ version = 1 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. @@ -106,7 +106,7 @@ version = 2 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task"] +searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ @@ -119,7 +119,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\ This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS. @@ -131,7 +131,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities. @@ -142,7 +142,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule"] +searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -154,7 +154,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Detect and investigate suspicious activities by users and roles in your cloud environments. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage. diff --git a/docs/detections.md b/docs/detections.md index eb7afde7d5..457231a412 100644 --- a/docs/detections.md +++ b/docs/detections.md @@ -117,6 +117,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [Amazon EKS Kubernetes Pod scan detection](#amazon-eks-kubernetes-pod-scan-detection) @@ -166,6 +168,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -274,6 +278,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -396,6 +402,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -540,6 +550,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -650,6 +662,22 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + @@ -1002,6 +1030,24 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + @@ -1116,6 +1162,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Account Discovery With Net App](#account-discovery-with-net-app) + + + @@ -1176,6 +1226,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [CMLUA Or CMSTPLUA UAC Bypass](#cmlua-or-cmstplua-uac-bypass) + + + - [CertUtil Download With URLCache and Split Arguments](#certutil-download-with-urlcache-and-split-arguments) @@ -1336,6 +1390,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [Deleting Shadow Copies](#deleting-shadow-copies) @@ -1476,6 +1532,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Detect RClone Command-Line Usage](#detect-rclone-command-line-usage) + + + - [Detect Rare Executables](#detect-rare-executables) @@ -1508,6 +1568,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Detect Renamed RClone](#detect-renamed-rclone) + + + - [Detect Rundll32 Application Control Bypass - advpack](#detect-rundll32-application-control-bypass---advpack) @@ -1694,6 +1758,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Extract SAM from Registry](#extract-sam-from-registry) + + + - [File with Samsam Extension](#file-with-samsam-extension) @@ -1876,6 +1944,38 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Multiple Disabled Users Failing To Authenticate From Host Using Kerberos](#multiple-disabled-users-failing-to-authenticate-from-host-using-kerberos) + + + +- [Multiple Invalid Users Failing To Authenticate From Host Using Kerberos](#multiple-invalid-users-failing-to-authenticate-from-host-using-kerberos) + + + +- [Multiple Invalid Users Failing To Authenticate From Host Using NTLM](#multiple-invalid-users-failing-to-authenticate-from-host-using-ntlm) + + + + + +- [Multiple Users Attempting To Authenticate Using Explicit Credentials](#multiple-users-attempting-to-authenticate-using-explicit-credentials) + + + +- [Multiple Users Failing To Authenticate From Host Using Kerberos](#multiple-users-failing-to-authenticate-from-host-using-kerberos) + + + +- [Multiple Users Failing To Authenticate From Host Using NTLM](#multiple-users-failing-to-authenticate-from-host-using-ntlm) + + + +- [Multiple Users Failing To Authenticate From Process](#multiple-users-failing-to-authenticate-from-process) + + + +- [Multiple Users Remotely Failing To Authenticate From Host](#multiple-users-remotely-failing-to-authenticate-from-host) + - [NLTest Domain Trust Discovery](#nltest-domain-trust-discovery) @@ -1974,6 +2074,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Powershell Remote Thread To Known Windows Process](#powershell-remote-thread-to-known-windows-process) + + + - [Probing Access with Stolen Credentials via PowerSploit modules](#probing-access-with-stolen-credentials-via-powersploit-modules) @@ -2128,6 +2232,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [SLUI RunAs Elevated](#slui-runas-elevated) + + + +- [SLUI Spawning a Process](#slui-spawning-a-process) + + + @@ -2142,6 +2254,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Schedule Task with HTTP Command Arguments](#schedule-task-with-http-command-arguments) + + + +- [Schedule Task with Rundll32 Command Trigger](#schedule-task-with-rundll32-command-trigger) + + + - [Scheduled Task Deleted Or Created via CMD](#scheduled-task-deleted-or-created-via-cmd) @@ -2180,10 +2300,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by -- [Shedule Task with HTTP Command Arguments](#shedule-task-with-http-command-arguments) - - - - [Shim Database File Creation](#shim-database-file-creation) @@ -2332,6 +2448,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Trickbot Named Pipe](#trickbot-named-pipe) + + + - [USN Journal Deletion](#usn-journal-deletion) @@ -2392,6 +2512,18 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Wermgr Process Connecting To IP Check Web Services](#wermgr-process-connecting-to-ip-check-web-services) + + + +- [Wermgr Process Create Executable File](#wermgr-process-create-executable-file) + + + +- [Wermgr Process Spawned CMD Or Powershell Process](#wermgr-process-spawned-cmd-or-powershell-process) + + + - [WinEvent Scheduled Task Created Within Public Path](#winevent-scheduled-task-created-within-public-path) @@ -2432,6 +2564,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Write Executable in SMB Share](#write-executable-in-smb-share) + + + @@ -2628,6 +2764,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -2651,6 +2791,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [Detect ARP Poisoning](#detect-arp-poisoning) @@ -2758,6 +2900,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -2942,6 +3088,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -3092,6 +3240,22 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + @@ -3128,6 +3292,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [Prohibited Network Traffic Allowed](#prohibited-network-traffic-allowed) @@ -3208,6 +3374,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -3328,6 +3498,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -3350,6 +3522,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -3399,6 +3573,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + @@ -3667,6 +3849,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + @@ -3817,6 +4005,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -3963,6 +4155,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -3978,6 +4172,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + - [Multiple Okta Users With Invalid Credentials From The Same IP](#multiple-okta-users-with-invalid-credentials-from-the-same-ip) @@ -3988,6 +4188,16 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + - [No Windows Updates in a time frame](#no-windows-updates-in-a-time-frame) @@ -4197,6 +4407,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + @@ -4301,6 +4519,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -4332,6 +4552,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + @@ -4572,6 +4800,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + @@ -4688,6 +4922,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -4898,6 +5136,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -5050,6 +5290,28 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + @@ -5114,6 +5376,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -5247,6 +5511,16 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + @@ -7694,6 +7968,91 @@ _version_: 2 --- +### Account Discovery With Net App +this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1087.002](https://attack.mitre.org/techniques/T1087/002/) +- **Last Updated**: 2021-05-03 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND (Processes.process="*user*" OR Processes.process="*config*" OR Processes.process="*view /all*") by Processes.process_name Processes.dest Processes.user Processes.parent_process_name +| where count >=5 +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `account_discovery_with_net_app_filter` +``` +#### Associated Analytic Story + +* Trickbot + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. + +#### Required field + +* _time + +* Processes.parent_process_name + +* Processes.parent_process_id + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.process_guid + +* Processes.dest + +* Processes.user + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1087.002 | Domain Account | Discovery | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin or power user may used this series of command. + +#### Reference + + +* https://labs.vipre.com/trickbot-and-its-modules/ + +* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + + +_version_: 1 +
+ +--- + ### Amazon EKS Kubernetes Pod scan detection This search provides detection information on unauthenticated requests against Kubernetes' Pods API @@ -8466,6 +8825,8 @@ This search looks for attempts to stop security-related services on the endpoint * Disabling Security Tools +* Trickbot + #### How To Implement You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. The search is shipped with a lookup file, `security_services.csv`, that can be edited to update the list of services to monitor. This lookup file can be edited directly where it lives in `$SPLUNK_HOME/etc/apps/DA-ESS-ContentUpdate/lookups`, or via the Splunk console. You should add the names of services an attacker might use on the command line and surround with asterisks (*****), so that they work properly when searching the command line. The file should be updated with the names of any services you would like to monitor for attempts to stop the service., @@ -8528,7 +8889,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Search ``` -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -8538,6 +8899,8 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th * Credential Dumping +* DarkSide Ransomware + #### How To Implement You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -8842,6 +9205,8 @@ The following query identifies Microsoft Background Intelligent Transfer Service * BITS Jobs +* DarkSide Ransomware + #### How To Implement To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -8968,6 +9333,87 @@ It is possible for this search to generate a notable event for a batch file writ * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log +_version_: 1 + + +--- + +### CMLUA Or CMSTPLUA UAC Bypass +This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1218.003](https://attack.mitre.org/techniques/T1218/003/) +- **Last Updated**: 2021-05-13 + +
+ details + +#### Search +``` +`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*", "*\\program files*")) +| stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `cmlua_or_cmstplua_uac_bypass_filter` +``` +#### Associated Analytic Story + +* DarkSide Ransomware + +* Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* Image + +* ImageLoaded + +* process_name + +* Computer + +* EventCode + +* Signed + +* ProcessId + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1218.003 | CMSTP | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Legitimate windows application that are not on the list loading this dll. Filter as needed. + +#### Reference + + +* https://attack.mitre.org/techniques/T1218/003/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon.log + + _version_: 1
@@ -8997,6 +9443,8 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th * Ingress Tool Transfer +* DarkSide Ransomware + #### How To Implement To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -9077,6 +9525,8 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T * Ingress Tool Transfer +* DarkSide Ransomware + #### How To Implement To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -10430,7 +10880,7 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe #### Search ``` -`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*, \\srvsvc_*, \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, \\winsock*) +`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*, \\srvsvc_*, \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, \\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, process_id process_path, PipeName | rename Computer as dest | `security_content_ctime(firstTime)` @@ -10441,6 +10891,10 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe * Cobalt Strike +* Trickbot + +* DarkSide Ransomware + #### How To Implement To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -10491,6 +10945,8 @@ The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some * https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752 +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + #### Test Dataset @@ -12700,6 +13156,79 @@ Limited false positives. If there is a true false positive, filter based on comm * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log +_version_: 1 + + +--- + +### Delete ShadowCopy With PowerShell +This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1490](https://attack.mitre.org/techniques/T1490/) +- **Last Updated**: 2021-05-12 + +
+ details + +#### Search +``` +`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `delete_shadowcopy_with_powershell_filter` +``` +#### Associated Analytic Story + +* DarkSide Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. + +#### Required field + +* _time + +* EventCode + +* Message + +* ComputerName + +* User + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1490 | Inhibit System Recovery | Impact | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + +* https://searchwindowsserver.techtarget.com/tutorial/Set-up-PowerShell-script-block-logging-for-added-security + + + +#### Test Dataset + + _version_: 1
@@ -15066,6 +15595,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi * Cloud Federated Credential Abuse +* DarkSide Ransomware + #### How To Implement This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. @@ -16189,6 +16720,8 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla * HAFNIUM Group +* DarkSide Ransomware + #### How To Implement You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -16235,6 +16768,92 @@ _version_: 3 --- +### Detect RClone Command-Line Usage +This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1020](https://attack.mitre.org/techniques/T1020/) +- **Last Updated**: 2021-05-13 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*copy*", "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_rclone_command_line_usage_filter` +``` +#### Associated Analytic Story + +* DarkSide Ransomware + +* Ransomware + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1020 | Automated Exfiltration | Exfiltration | + + +#### Kill Chain Phase + +* Exfiltration + + +#### Known False Positives +There is potential for false positives as these arguments may be used by other applications. Filter or tune the analytic as needed. + +#### Reference + + +* https://redcanary.com/blog/rclone-mega-extortion/ + +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + +* https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log + + +_version_: 1 +
+ +--- + ### Detect Rare Executables This search will return a table of rare processes, the names of the systems running them, and the users who initiated each process. @@ -16920,6 +17539,88 @@ Limited false positives related to third party software registering .DLL's. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log +_version_: 1 + + +--- + +### Detect Renamed RClone +The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from the legitimate site and executed accordingly. During triage, isolate the endpoint and begin to review parallel processes for additional behavior. At this stage, the adversary may have staged data to be exfiltrated. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: [T1020](https://attack.mitre.org/techniques/T1020/) +- **Last Updated**: 2021-05-13 + +
+ details + +#### Search +``` +`sysmon` EventID=1 OriginalFileName=rclone.exe NOT process_name=rclone.exe +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_renamed_rclone_filter` +``` +#### Associated Analytic Story + +* DarkSide Ransomware + +* Ransomware + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* OriginalFileName + +* process_name + +* process_path + +* CommandLine + +* dest + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1020 | Automated Exfiltration | Exfiltration | + + +#### Kill Chain Phase + +* Exfiltration + + +#### Known False Positives +False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case. + +#### Reference + + +* https://redcanary.com/blog/rclone-mega-extortion/ + +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + +* https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log + + _version_: 1
@@ -21789,6 +22490,90 @@ None identified #### Test Dataset +_version_: 1 + + +--- + +### Extract SAM from Registry +The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from a untrusted process or script. Upon execution, a file will be written to disk. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1003.002](https://attack.mitre.org/techniques/T1003/002/) +- **Last Updated**: 2021-05-12 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*sam* OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `extract_sam_from_registry_filter` +``` +#### Associated Analytic Story + +* DarkSide Ransomware + +* Credential Dumping + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1003.002 | Security Account Manager | Credential Access | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +It is possible some agent based products will generate false positives. Filter as needed. + +#### Reference + + +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + + _version_: 1
@@ -26096,6 +26881,247 @@ Normal archive transfer via HTTP protocol may trip this detection. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/archive_http_post/stream_http_events.log +_version_: 1 + + +--- + +### Multiple Disabled Users Failing To Authenticate From Host Using Kerberos +The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1110.003](https://attack.mitre.org/techniques/T1110/003/) +- **Last Updated**: 2021-04-14 + +
+ details + +#### Search +``` +`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 +| bucket span=2m _time +| stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter` +``` +#### Associated Analytic Story + +* Active Directory Password Spraying + + +#### How To Implement +To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. + +#### Required field + +* _time + +* EventCode + +* Result_Code + +* Account_Name + +* Client_Address + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1110.003 | Password Spraying | Credential Access | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems. + +#### Reference + + +* https://attack.mitre.org/techniques/T1110/003/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log + + +_version_: 1 +
+ +--- + +### Multiple Invalid Users Failing To Authenticate From Host Using Kerberos +The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1110.003](https://attack.mitre.org/techniques/T1110/003/) +- **Last Updated**: 2021-04-14 + +
+ details + +#### Search +``` +`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" +| bucket span=2m _time +| stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter` +``` +#### Associated Analytic Story + +* Active Directory Password Spraying + + +#### How To Implement +To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. + +#### Required field + +* _time + +* EventCode + +* Result_Code + +* Account_Name + +* Client_Address + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1110.003 | Password Spraying | Credential Access | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems. + +#### Reference + + +* https://attack.mitre.org/techniques/T1110/003/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log + + +_version_: 1 +
+ +--- + +### Multiple Invalid Users Failing To Authenticate From Host Using NTLM +The following analytic identifies one source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC0000064 stands for `The username you typed does not exist` (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1110.003](https://attack.mitre.org/techniques/T1110/003/) +- **Last Updated**: 2021-04-15 + +
+ details + +#### Search +``` + `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure +| bucket span=2m _time +| stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter` +``` +#### Associated Analytic Story + +* Active Directory Password Spraying + + +#### How To Implement +To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled. + +#### Required field + +* _time + +* EventCode + +* action + +* Logon_Account + +* Source_Workstation + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1110.003 | Password Spraying | Credential Access | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. + +#### Reference + + +* https://attack.mitre.org/techniques/T1110/003/ + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log + + _version_: 1
@@ -26174,6 +27200,439 @@ _version_: 2 --- +### Multiple Users Attempting To Authenticate Using Explicit Credentials +The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1110.003](https://attack.mitre.org/techniques/T1110/003/) +- **Last Updated**: 2021-04-13 + +
+ details + +#### Search +``` + `wineventlog_security` EventCode=4648 +| bucket span=2m _time +| eval Source_Account = mvindex(Account_Name, 0) +| eval Destination_Account = mvindex(Account_Name, 1) +| search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" +| stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` +``` +#### Associated Analytic Story + +* Active Directory Password Spraying + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. + +#### Required field + +* _time + +* EventCode + +* Security_ID + +* Account_Name + +* ComputerName + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1110.003 | Password Spraying | Credential Access | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. + +#### Reference + + +* https://attack.mitre.org/techniques/T1110/003/ + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648 + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log + + +_version_: 1 +
+ +--- + +### Multiple Users Failing To Authenticate From Host Using Kerberos +The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1110.003](https://attack.mitre.org/techniques/T1110/003/) +- **Last Updated**: 2021-04-08 + +
+ details + +#### Search +``` +`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$" +| bucket span=2m _time +| stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter` +``` +#### Associated Analytic Story + +* Active Directory Password Spraying + + +#### How To Implement +To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. + +#### Required field + +* _time + +* EventCode + +* Result_Code + +* Account_Name + +* Client_Address + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1110.003 | Password Spraying | Credential Access | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, missconfigured systems and multi-user systems like Citrix farms. + +#### Reference + + +* https://attack.mitre.org/techniques/T1110/003/ + +* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319109(v=ws.11) + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771 + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log + + +_version_: 1 +
+ +--- + +### Multiple Users Failing To Authenticate From Host Using NTLM +The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1110.003](https://attack.mitre.org/techniques/T1110/003/) +- **Last Updated**: 2021-04-13 + +
+ details + +#### Search +``` + `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure +| bucket span=2m _time +| stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter` +``` +#### Associated Analytic Story + +* Active Directory Password Spraying + + +#### How To Implement +To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled. + +#### Required field + +* _time + +* EventCode + +* action + +* Logon_Account + +* Source_Workstation + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1110.003 | Password Spraying | Credential Access | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. + +#### Reference + + +* https://attack.mitre.org/techniques/T1110/003/ + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log + + +_version_: 1 +
+ +--- + +### Multiple Users Failing To Authenticate From Process +The following analytic identifies a source process name failing to authenticate with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 generates on domain controllers, member servers, and workstations when an account fails to logon. Logon Type 2 describes an iteractive logon attempt.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed. This could be a domain controller as well as a member server or workstation.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1110.003](https://attack.mitre.org/techniques/T1110/003/) +- **Last Updated**: 2021-04-13 + +
+ details + +#### Search +``` + `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-" +| bucket span=2m _time +| eval Source_Account = mvindex(Account_Name, 0) +| eval Destination_Account = mvindex(Account_Name, 1) +| stats dc(Destination_Account) AS unique_accounts values(Account_Name) as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Caller_Process_Name, Source_Account, ComputerName +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_users_failing_to_authenticate_from_process_filter` +``` +#### Associated Analytic Story + +* Active Directory Password Spraying + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. + +#### Required field + +* _time + +* EventCode + +* Logon_Type + +* Caller_Process_Name + +* Security_ID + +* Account_Name + +* ComputerName + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1110.003 | Password Spraying | Credential Access | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +A process failing to authenticate with multiple users is not a common behavior for legitimate user sessions. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. + +#### Reference + + +* https://attack.mitre.org/techniques/T1110/003/ + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 + +* https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log + + +_version_: 1 +
+ +--- + +### Multiple Users Remotely Failing To Authenticate From Host +The following analytic identifies a source host failing to authenticate against a remote host with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 describes an remote authentication attempt.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server or workstation.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1110.003](https://attack.mitre.org/techniques/T1110/003/) +- **Last Updated**: 2021-04-13 + +
+ details + +#### Search +``` + `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-" +| bucket span=2m _time +| eval Destination_Account = mvindex(Account_Name, 1) +| stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts by _time, Source_Network_Address, ComputerName +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_users_remotely_failing_to_authenticate_from_host_filter` +``` +#### Associated Analytic Story + +* Active Directory Password Spraying + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. + +#### Required field + +* _time + +* EventCode + +* Logon_Type + +* Security_ID + +* Account_Name + +* ComputerName + +* Source_Network_Address + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1110.003 | Password Spraying | Credential Access | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc. + +#### Reference + + +* https://attack.mitre.org/techniques/T1110/003/ + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 + +* https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log + + +_version_: 1 +
+ +--- + ### NLTest Domain Trust Discovery This search looks for the execution of `nltest.exe` with command-line arguments utilized to query for Domain Trust information. Two arguments `/domain trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current domain to assist with further understanding where to pivot next. @@ -27450,7 +28909,7 @@ this detection was designed to identifies suspicious spawned process of known MS #### Search ``` -| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name = "wordpad.exe") Processes.process_name=rundll32.exe by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.user Processes.dest +| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") Processes.process_name=rundll32.exe by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` @@ -27460,6 +28919,8 @@ this detection was designed to identifies suspicious spawned process of known MS * Spearphishing Attachments +* Trickbot + #### How To Implement To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -27529,7 +28990,7 @@ this search detects a potential malicious office document that create schedule t #### Search ``` -`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "wordpad.exe") ImageLoaded = "*\\taskschd.dll" +`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -27612,7 +29073,7 @@ this detection was designed to identifies suspicious office documents that using #### Search ``` -`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "wordpad.exe") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") +`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -27622,6 +29083,8 @@ this detection was designed to identifies suspicious office documents that using * Spearphishing Attachments +* Trickbot + #### How To Implement To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. @@ -27693,7 +29156,7 @@ this search is to detect potential malicious office document executing lolbin ch #### Search ``` -`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", "excel.exe", "visio.exe", "wordpad.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) +`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", "excel.exe", "visio.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -28749,6 +30212,91 @@ Limited false positives. It is possible administrators will utilize Start-BitsTr * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log +_version_: 1 + + +--- + +### Powershell Remote Thread To Known Windows Process +this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1055](https://attack.mitre.org/techniques/T1055/) +- **Last Updated**: 2021-04-19 + +
+ details + +#### Search +``` +`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe") TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") +| stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress Computer EventCode +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_remote_thread_to_known_windows_process_filter` +``` +#### Associated Analytic Story + +* Trickbot + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, Create Remote thread from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of create remote thread may be used. + +#### Required field + +* _time + +* SourceImage + +* process_name + +* SourceProcessId + +* SourceProcessGuid + +* TargetImage + +* TargetProcessId + +* NewThreadId + +* StartAddress + +* Computer + +* EventCode + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1055 | Process Injection | Defense Evasion, Privilege Escalation | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + + _version_: 1
@@ -29571,8 +31119,9 @@ The following analytics identifies a big number of instance of ransomware notes #### Search ``` `sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") +|bin _time span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer Image file_name -| where unique_readme_path_count >= 50 +| where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter` @@ -29581,6 +31130,8 @@ The following analytics identifies a big number of instance of ransomware notes * Clop Ransomware +* DarkSide Ransomware + #### How To Implement You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. @@ -30984,7 +32535,7 @@ _version_: 2 The search looks for modifications to registry keys that can be used to launch an application or service at system startup. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: +- **Datamodel**: Endpoint - **ATT&CK**: [T1547.001](https://attack.mitre.org/techniques/T1547/001/) - **Last Updated**: 2020-11-27 @@ -32020,6 +33571,182 @@ Limited to no known false positives. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log +_version_: 1 + + +--- + +### SLUI RunAs Elevated +The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This particular bypass utilizes a registry key/value. Identified by two sources, the registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`. To simulate this behavior, multiple POC are available. The analytic identifies the use of `runas` by `slui.exe`. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1548.002](https://attack.mitre.org/techniques/T1548/002/) +- **Last Updated**: 2021-05-13 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=slui.exe (Processes.process=*-verb* Processes.process=*runas*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `slui_runas_elevated_filter` +``` +#### Associated Analytic Story + +* DarkSide Ransomware + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Limited false positives should be present as this is not commonly used by legitimate applications. + +#### Reference + + +* https://www.exploit-db.com/exploits/46998 + +* https://medium.com/@mattharr0ey/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b + +* https://gist.github.com/r00t-3xp10it/0c92cd554d3156fd74f6c25660ccc466 + +* https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/ + +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### SLUI Spawning a Process +The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, spawning a child process. This behavior is associated with publicly known UAC bypass. `slui.exe` is commonly associated with software updates and is most often spawned by `svchost.exe`. The `slui.exe` process should not have child processes, and any processes spawning from it will be running with elevated privileges. During triage, review the child process and additional parallel processes. Identify any file modifications that may have lead to the bypass. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1548.002](https://attack.mitre.org/techniques/T1548/002/) +- **Last Updated**: 2021-05-13 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=slui.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `slui_spawning_a_process_filter` +``` +#### Associated Analytic Story + +* DarkSide Ransomware + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Certain applications may spawn from `slui.exe` that are legitimate. Filtering will be needed to ensure proper monitoring. + +#### Reference + + +* https://www.exploit-db.com/exploits/46998 + +* https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/ + +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log + + _version_: 1
@@ -32408,6 +34135,172 @@ _version_: 4 --- +### Schedule Task with HTTP Command Arguments +The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1053](https://attack.mitre.org/techniques/T1053/) +- **Last Updated**: 2021-04-19 + +
+ details + +#### Search +``` +`wineventlog_security` EventCode=4698 +| xmlkv Message +| search Arguments IN ("*http*") +| stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `schedule_task_with_http_command_arguments_filter` +``` +#### Associated Analytic Story + +* Windows Persistence Techniques + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. + +#### Required field + +* _time + +* dest + +* Task_Name + +* Command + +* Author + +* Enabled + +* Hidden + +* Arguments + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log + + +_version_: 1 +
+ +--- + +### Schedule Task with Rundll32 Command Trigger +The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1053](https://attack.mitre.org/techniques/T1053/) +- **Last Updated**: 2021-04-19 + +
+ details + +#### Search +``` +`wineventlog_security` EventCode=4698 +| xmlkv Message +| search Command IN ("*rundll32*") +| stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `schedule_task_with_rundll32_command_trigger_filter` +``` +#### Associated Analytic Story + +* Windows Persistence Techniques + +* Trickbot + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. + +#### Required field + +* _time + +* dest + +* Task_Name + +* Command + +* Author + +* Enabled + +* Hidden + +* Arguments + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://labs.vipre.com/trickbot-and-its-modules/ + +* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log + + +_version_: 1 +
+ +--- + ### Scheduled Task Deleted Or Created via CMD This search looks for flags passed to schtasks.exe on the command-line that indicate a task was created via command like. This has been associated with the Dragonfly threat actor, and the SUNBURST attack against Solarwinds. @@ -33148,87 +35041,6 @@ None identified. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log -_version_: 1 - - ---- - -### Shedule Task with HTTP Command Arguments -The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine.\ The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' - -- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: Endpoint -- **ATT&CK**: [T1053](https://attack.mitre.org/techniques/T1053/) -- **Last Updated**: 2021-04-19 - -
- details - -#### Search -``` -`wineventlog_security` EventCode=4698 -| xmlkv Message -| search Arguments IN ("*http*") -| stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `shedule_task_with_http_command_arguments_filter` -``` -#### Associated Analytic Story - -* Windows Persistence Techniques - - -#### How To Implement -To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. - -#### Required field - -* _time - -* dest - -* Task_Name - -* Command - -* Author - -* Enabled - -* Hidden - -* Arguments - - - -#### ATT&CK - -| ID | Technique | Tactic | -| ----------- | ----------- |--------------| -| T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | - - -#### Kill Chain Phase - -* Exploitation - - -#### Known False Positives -unknown - -#### Reference - - -* https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ - - - -#### Test Dataset - -* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log - - _version_: 1
@@ -35045,6 +36857,8 @@ The following analytic identifies rundll32.exe executing a DLL function name, St * Cobalt Strike +* Trickbot + #### How To Implement To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -36292,7 +38106,6 @@ $cond_6 = | union $cond_4 | union $cond_5 | union $cond_6 -| | where process_path NOT LIKE "%\\windows\\system32%" OR process_path NOT LIKE "%\\windows\\syswow64%" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user), body=create_map(["process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events(); @@ -36516,6 +38329,87 @@ _version_: 2 --- +### Trickbot Named Pipe +this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1055](https://attack.mitre.org/techniques/T1055/) +- **Last Updated**: 2021-04-26 + +
+ details + +#### Search +``` +`sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" +| stats min(_time) as firstTime max(_time) as lastTime count by Computer user_id EventCode PipeName signature Image process_id +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `trickbot_named_pipe_filter` +``` +#### Associated Analytic Story + +* Trickbot + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. . + +#### Required field + +* _time + +* Computer + +* user_id + +* EventCode + +* PipeName + +* signature + +* Image + +* process_id + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1055 | Process Injection | Defense Evasion, Privilege Escalation | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://labs.vipre.com/trickbot-and-its-modules/ + +* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log + + +_version_: 1 +
+ +--- + ### USN Journal Deletion The fsutil.exe application is a legitimate Windows utility used to perform tasks related to the file allocation table (FAT) and NTFS file systems. The update sequence number (USN) change journal provides a log of all changes made to the files on the disk. This search looks for fsutil.exe deleting the USN journal. @@ -37872,6 +39766,252 @@ Some of these processes may be used legitimately on web servers during maintenan #### Test Dataset +_version_: 1 + + +--- + +### Wermgr Process Connecting To IP Check Web Services +this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1590.005](https://attack.mitre.org/techniques/T1590/005/) +- **Last Updated**: 2021-04-19 + +
+ details + +#### Search +``` +`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") +| stats min(_time) as firstTime max(_time) as lastTime count by process_path process_name process_id QueryName QueryStatus QueryResults Computer EventCode +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `wermgr_process_connecting_to_ip_check_web_services_filter` +``` +#### Associated Analytic Story + +* Trickbot + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA. + +#### Required field + +* _time + +* process_path + +* process_name + +* process_id + +* QueryName + +* QueryStatus + +* QueryResults + +* Computer + +* EventCode + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1590.005 | IP Addresses | Reconnaissance | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://labs.vipre.com/trickbot-and-its-modules/ + +* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Wermgr Process Create Executable File +this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop executable file. This technique is commonly seen in trickbot malware where it injects it code to this process to execute it malicious behavior like downloading other payload + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1027](https://attack.mitre.org/techniques/T1027/) +- **Last Updated**: 2021-04-19 + +
+ details + +#### Search +``` +`sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe" +| stats min(_time) as firstTime max(_time) as lastTime count by Image TargetFilename process_name dest EventCode ProcessId +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `wermgr_process_create_executable_file_filter` +``` +#### Associated Analytic Story + +* Trickbot + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of wermgr.exe may be used. + +#### Required field + +* _time + +* Image + +* TargetFilename + +* process_name + +* dest + +* EventCode + +* ProcessId + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1027 | Obfuscated Files or Information | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://labs.vipre.com/trickbot-and-its-modules/ + +* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Wermgr Process Spawned CMD Or Powershell Process +This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1059](https://attack.mitre.org/techniques/T1059/) +- **Last Updated**: 2021-04-19 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` values(Processes.process) as cmdline min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe" OR Processes.process_name = "powershell.exe" by Processes.parent_process_name Processes.parent_process_id Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `wermgr_process_spawned_cmd_or_powershell_process_filter` +``` +#### Associated Analytic Story + +* Trickbot + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* Processes.parent_process_name + +* Processes.parent_process_id + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.process_guid + +* Processes.dest + +* Processes.user + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1059 | Command and Scripting Interpreter | Execution | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + + +* https://labs.vipre.com/trickbot-and-its-modules/ + +* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + + _version_: 1
@@ -38710,6 +40850,89 @@ There will be limited false positives and it will be different for every environ * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_wsh.log +_version_: 1 + + +--- + +### Write Executable in SMB Share +This search is to detect suspicious dropping or creating an executable file in known sensitive SMB share. This technique is commonly used for lateral movement like how trickbot try to infect other machine in the infected network. This detection catch the access event (FILE WRITE) access to a share. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1021.002](https://attack.mitre.org/techniques/T1021/002/) +- **Last Updated**: 2021-04-23 + +
+ details + +#### Search +``` +`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" +| stats min(_time) as firstTime max(_time) as lastTime count by EventCode Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `write_executable_in_smb_share_filter` +``` +#### Associated Analytic Story + +* Trickbot + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. + +#### Required field + +* _time + +* EventCode + +* Share_Name + +* Relative_Target_Name + +* Object_Type + +* Access_Mask + +* user + +* src_port + +* Source_Address + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1021.002 | SMB/Windows Admin Shares | Lateral Movement | + + +#### Kill Chain Phase + +* Lateral Movement + + +#### Known False Positives +unknown + +#### Reference + + +* https://labs.vipre.com/trickbot-and-its-modules/ + +* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html + + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log + + _version_: 1
diff --git a/docs/detections.wiki b/docs/detections.wiki index 06a65f2db1..42f00cdbf9 100644 --- a/docs/detections.wiki +++ b/docs/detections.wiki @@ -12281,6 +12281,96 @@ Administrators can create memory dumps for debugging purposes, but memory dumps ---- +===Account discovery with net app=== +this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, or even drop its module that will execute the said series of net command. This series of command are good correlation search and indicator of attacker recon if seen in the machines within a none technical user or department (HR, finance, ceo and etc) network. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087/002/ T1087.002] +* '''Last Updated''': 2021-05-03 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND (Processes.process="*user*" OR Processes.process="*config*" OR Processes.process="*view /all*") by Processes.process_name Processes.dest Processes.user Processes.parent_process_name +| where count >=5 +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `account_discovery_with_net_app_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. + +====Required field==== + +* _time + +* Processes.parent_process_name + +* Processes.parent_process_id + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.process_guid + +* Processes.dest + +* Processes.user + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1087.002 +| Domain Account +| Discovery +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin or power user may used this series of command. + +====Reference==== + + +* https://labs.vipre.com/trickbot-and-its-modules/ + +* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===Anomalous usage of 7zip=== The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`. It has been observed where an adversary will rename `7z.exe`. Additional coverage may be required to identify the behavior of renamed instances of `7z.exe`. During triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture any files written to disk and analyze as needed. Review parallel processes for additional behaviors. Typically, archiving files will result in exfiltration. @@ -13000,6 +13090,8 @@ This search looks for attempts to stop security-related services on the endpoint * [[Documentation:ESSOC:stories:UseCase#Disabling_Security_Tools|Disabling Security Tools]] +* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]] + ====How To Implement==== You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. The search is shipped with a lookup file, `security_services.csv`, that can be edited to update the list of services to monitor. This lookup file can be edited directly where it lives in `$SPLUNK_HOME/etc/apps/DA-ESS-ContentUpdate/lookups`, or via the Splunk console. You should add the names of services an attacker might use on the command line and surround with asterisks (*****), so that they work properly when searching the command line. The file should be updated with the names of any services you would like to monitor for attempts to stop the service., @@ -13067,7 +13159,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -13077,6 +13169,8 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th * [[Documentation:ESSOC:stories:UseCase#Credential_Dumping|Credential Dumping]] +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + ====How To Implement==== You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -13401,6 +13495,8 @@ The following query identifies Microsoft Background Intelligent Transfer Service * [[Documentation:ESSOC:stories:UseCase#BITS_Jobs|BITS Jobs]] +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + ====How To Implement==== To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -13540,6 +13636,92 @@ It is possible for this search to generate a notable event for a batch file writ * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log +''version'': 1 + + + +---- + +===Cmlua or cmstplua uac bypass=== +This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/003/ T1218.003] +* '''Last Updated''': 2021-05-13 + +
+
+ +====Search==== +`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*", "*\\program files*")) +| stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `cmlua_or_cmstplua_uac_bypass_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* Image + +* ImageLoaded + +* process_name + +* Computer + +* EventCode + +* Signed + +* ProcessId + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1218.003 +| CMSTP +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Legitimate windows application that are not on the list loading this dll. Filter as needed. + +====Reference==== + + +* https://attack.mitre.org/techniques/T1218/003/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon.log + + ''version'': 1
@@ -13569,6 +13751,8 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th * [[Documentation:ESSOC:stories:UseCase#Ingress_Tool_Transfer|Ingress Tool Transfer]] +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + ====How To Implement==== To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -13654,6 +13838,8 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T * [[Documentation:ESSOC:stories:UseCase#Ingress_Tool_Transfer|Ingress Tool Transfer]] +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + ====How To Implement==== To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -14132,7 +14318,7 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe
====Search==== -`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*, \\srvsvc_*, \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, \\winsock*) +`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*, \\srvsvc_*, \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, \\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, process_id process_path, PipeName | rename Computer as dest | `security_content_ctime(firstTime)` @@ -14143,6 +14329,10 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe * [[Documentation:ESSOC:stories:UseCase#Cobalt_Strike|Cobalt Strike]] +* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]] + +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + ====How To Implement==== To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -14198,6 +14388,8 @@ The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some * https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752 +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + ====Test Dataset==== @@ -17640,6 +17832,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi * [[Documentation:ESSOC:stories:UseCase#Cloud_Federated_Credential_Abuse|Cloud Federated Credential Abuse]] +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + ====How To Implement==== This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. @@ -18241,6 +18435,8 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla * [[Documentation:ESSOC:stories:UseCase#HAFNIUM_Group|HAFNIUM Group]] +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + ====How To Implement==== You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. @@ -18293,6 +18489,97 @@ Administrators can leverage PsExec for accessing remote systems and might pass ` ---- +===Detect rclone command-line usage=== +This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1020/ T1020] +* '''Last Updated''': 2021-05-13 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*copy*", "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_rclone_command_line_usage_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1020 +| Automated Exfiltration +| Exfiltration +|} + + +====Kill Chain Phase==== + +* Exfiltration + + +====Known False Positives==== +There is potential for false positives as these arguments may be used by other applications. Filter or tune the analytic as needed. + +====Reference==== + + +* https://redcanary.com/blog/rclone-mega-extortion/ + +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + +* https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===Detect rare executables=== This search will return a table of rare processes, the names of the systems running them, and the users who initiated each process. @@ -19012,6 +19299,93 @@ Limited false positives related to third party software registering .DLL's. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log +''version'': 1 +
+ + +---- + +===Detect renamed rclone=== +The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from the legitimate site and executed accordingly. During triage, isolate the endpoint and begin to review parallel processes for additional behavior. At this stage, the adversary may have staged data to be exfiltrated. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1020/ T1020] +* '''Last Updated''': 2021-05-13 + +
+
+ +====Search==== +`sysmon` EventID=1 OriginalFileName=rclone.exe NOT process_name=rclone.exe +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `detect_renamed_rclone_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* OriginalFileName + +* process_name + +* process_path + +* CommandLine + +* dest + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1020 +| Automated Exfiltration +| Exfiltration +|} + + +====Kill Chain Phase==== + +* Exfiltration + + +====Known False Positives==== +False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case. + +====Reference==== + + +* https://redcanary.com/blog/rclone-mega-extortion/ + +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + +* https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log + + ''version'': 1
@@ -21502,6 +21876,95 @@ None identified. ---- +===Extract sam from registry=== +The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from a untrusted process or script. Upon execution, a file will be written to disk. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/002/ T1003.002] +* '''Last Updated''': 2021-05-12 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*sam* OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `extract_sam_from_registry_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Credential_Dumping|Credential Dumping]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1003.002 +| Security Account Manager +| Credential Access +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +It is possible some agent based products will generate false positives. Filter as needed. + +====Reference==== + + +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===File with samsam extension=== The search looks for file writes with extensions consistent with a SamSam ransomware attack. @@ -23849,6 +24312,720 @@ Some administrative tasks may involve multiple use of LOLBAS applications in a s ====Test Dataset==== +''version'': 1 + + + +---- + +===Multiple disabled users failing to authenticate from host using kerberos=== +The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''Last Updated''': 2021-04-14 + +
+
+ +====Search==== +`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 +| bucket span=2m _time +| stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. + +====Required field==== + +* _time + +* EventCode + +* Result_Code + +* Account_Name + +* Client_Address + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1110.003 +| Password Spraying +| Credential Access +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems. + +====Reference==== + + +* https://attack.mitre.org/techniques/T1110/003/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log + + +''version'': 1 +
+
+ +---- + +===Multiple invalid users failing to authenticate from host using kerberos=== +The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''Last Updated''': 2021-04-14 + +
+
+ +====Search==== +`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" +| bucket span=2m _time +| stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. + +====Required field==== + +* _time + +* EventCode + +* Result_Code + +* Account_Name + +* Client_Address + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1110.003 +| Password Spraying +| Credential Access +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems. + +====Reference==== + + +* https://attack.mitre.org/techniques/T1110/003/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log + + +''version'': 1 +
+
+ +---- + +===Multiple invalid users failing to authenticate from host using ntlm=== +The following analytic identifies one source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC0000064 stands for `The username you typed does not exist` (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''Last Updated''': 2021-04-15 + +
+
+ +====Search==== + `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure +| bucket span=2m _time +| stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled. + +====Required field==== + +* _time + +* EventCode + +* action + +* Logon_Account + +* Source_Workstation + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1110.003 +| Password Spraying +| Credential Access +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. + +====Reference==== + + +* https://attack.mitre.org/techniques/T1110/003/ + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log + + +''version'': 1 +
+
+ +---- + +===Multiple users attempting to authenticate using explicit credentials=== +The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''Last Updated''': 2021-04-13 + +
+
+ +====Search==== + `wineventlog_security` EventCode=4648 +| bucket span=2m _time +| eval Source_Account = mvindex(Account_Name, 0) +| eval Destination_Account = mvindex(Account_Name, 1) +| search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" +| stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. + +====Required field==== + +* _time + +* EventCode + +* Security_ID + +* Account_Name + +* ComputerName + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1110.003 +| Password Spraying +| Credential Access +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. + +====Reference==== + + +* https://attack.mitre.org/techniques/T1110/003/ + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648 + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log + + +''version'': 1 +
+
+ +---- + +===Multiple users failing to authenticate from host using kerberos=== +The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''Last Updated''': 2021-04-08 + +
+
+ +====Search==== +`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$" +| bucket span=2m _time +| stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. + +====Required field==== + +* _time + +* EventCode + +* Result_Code + +* Account_Name + +* Client_Address + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1110.003 +| Password Spraying +| Credential Access +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, missconfigured systems and multi-user systems like Citrix farms. + +====Reference==== + + +* https://attack.mitre.org/techniques/T1110/003/ + +* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319109(v=ws.11) + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771 + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log + + +''version'': 1 +
+
+ +---- + +===Multiple users failing to authenticate from host using ntlm=== +The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted user is a legitimate domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''Last Updated''': 2021-04-13 + +
+
+ +====Search==== + `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure +| bucket span=2m _time +| stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled. + +====Required field==== + +* _time + +* EventCode + +* action + +* Logon_Account + +* Source_Workstation + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1110.003 +| Password Spraying +| Credential Access +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. + +====Reference==== + + +* https://attack.mitre.org/techniques/T1110/003/ + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log + + +''version'': 1 +
+
+ +---- + +===Multiple users failing to authenticate from process=== +The following analytic identifies a source process name failing to authenticate with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 generates on domain controllers, member servers, and workstations when an account fails to logon. Logon Type 2 describes an iteractive logon attempt.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed. This could be a domain controller as well as a member server or workstation.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''Last Updated''': 2021-04-13 + +
+
+ +====Search==== + `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-" +| bucket span=2m _time +| eval Source_Account = mvindex(Account_Name, 0) +| eval Destination_Account = mvindex(Account_Name, 1) +| stats dc(Destination_Account) AS unique_accounts values(Account_Name) as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Caller_Process_Name, Source_Account, ComputerName +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_users_failing_to_authenticate_from_process_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. + +====Required field==== + +* _time + +* EventCode + +* Logon_Type + +* Caller_Process_Name + +* Security_ID + +* Account_Name + +* ComputerName + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1110.003 +| Password Spraying +| Credential Access +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +A process failing to authenticate with multiple users is not a common behavior for legitimate user sessions. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. + +====Reference==== + + +* https://attack.mitre.org/techniques/T1110/003/ + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 + +* https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log + + +''version'': 1 +
+
+ +---- + +===Multiple users remotely failing to authenticate from host=== +The following analytic identifies a source host failing to authenticate against a remote host with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 describes an remote authentication attempt.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server or workstation.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/003/ T1110.003] +* '''Last Updated''': 2021-04-13 + +
+
+ +====Search==== + `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-" +| bucket span=2m _time +| eval Destination_Account = mvindex(Account_Name, 1) +| stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts by _time, Source_Network_Address, ComputerName +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `multiple_users_remotely_failing_to_authenticate_from_host_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. + +====Required field==== + +* _time + +* EventCode + +* Logon_Type + +* Security_ID + +* Account_Name + +* ComputerName + +* Source_Network_Address + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1110.003 +| Password Spraying +| Credential Access +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc. + +====Reference==== + + +* https://attack.mitre.org/techniques/T1110/003/ + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 + +* https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625 + +* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log + + ''version'': 1
@@ -24155,7 +25332,7 @@ this detection was designed to identifies suspicious spawned process of known MS ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe" OR Processes.parent_process_name = "wordpad.exe") Processes.process_name=rundll32.exe by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.user Processes.dest +| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") Processes.process_name=rundll32.exe by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` @@ -24165,6 +25342,8 @@ this detection was designed to identifies suspicious spawned process of known MS * [[Documentation:ESSOC:stories:UseCase#Spearphishing_Attachments|Spearphishing Attachments]] +* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]] + ====How To Implement==== To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -24239,7 +25418,7 @@ this search detects a potential malicious office document that create schedule t
====Search==== -`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "wordpad.exe") ImageLoaded = "*\\taskschd.dll" +`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -24327,7 +25506,7 @@ this detection was designed to identifies suspicious office documents that using
====Search==== -`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "wordpad.exe") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") +`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -24337,6 +25516,8 @@ this detection was designed to identifies suspicious office documents that using * [[Documentation:ESSOC:stories:UseCase#Spearphishing_Attachments|Spearphishing Attachments]] +* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]] + ====How To Implement==== To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. @@ -24413,7 +25594,7 @@ this search is to detect potential malicious office document executing lolbin ch
====Search==== -`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", "excel.exe", "visio.exe", "wordpad.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) +`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", "excel.exe", "visio.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -25066,6 +26247,96 @@ Limited false positives. It is possible administrators will utilize Start-BitsTr * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log +''version'': 1 +
+
+ +---- + +===Powershell remote thread to known windows process=== +this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1055/ T1055] +* '''Last Updated''': 2021-04-19 + +
+
+ +====Search==== +`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe") TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") +| stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress Computer EventCode +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_remote_thread_to_known_windows_process_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, Create Remote thread from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of create remote thread may be used. + +====Required field==== + +* _time + +* SourceImage + +* process_name + +* SourceProcessId + +* SourceProcessGuid + +* TargetImage + +* TargetProcessId + +* NewThreadId + +* StartAddress + +* Computer + +* EventCode + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1055 +| Process Injection +| Defense Evasion, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + + ''version'': 1
@@ -25581,8 +26852,9 @@ The following analytics identifies a big number of instance of ransomware notes ====Search==== `sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") +|bin _time span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer Image file_name -| where unique_readme_path_count >= 50 +| where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter` @@ -25591,6 +26863,8 @@ The following analytics identifies a big number of instance of ransomware notes * [[Documentation:ESSOC:stories:UseCase#Clop_Ransomware|Clop Ransomware]] +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + ====How To Implement==== You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. @@ -27055,7 +28329,7 @@ It is unusual for a service to be created or modified by directly manipulating t The search looks for modifications to registry keys that can be used to launch an application or service at system startup. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': Endpoint * '''ATT&CK''': [https://attack.mitre.org/techniques/T1547/001/ T1547.001] * '''Last Updated''': 2020-11-27 @@ -27871,6 +29145,192 @@ Limited to no known false positives. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log +''version'': 1 +
+ + +---- + +===Slui runas elevated=== +The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This particular bypass utilizes a registry key/value. Identified by two sources, the registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`. To simulate this behavior, multiple POC are available. The analytic identifies the use of `runas` by `slui.exe`. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002] +* '''Last Updated''': 2021-05-13 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=slui.exe (Processes.process=*-verb* Processes.process=*runas*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `slui_runas_elevated_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1548.002 +| Bypass User Account Control +| Defense Evasion, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Limited false positives should be present as this is not commonly used by legitimate applications. + +====Reference==== + + +* https://www.exploit-db.com/exploits/46998 + +* https://medium.com/@mattharr0ey/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b + +* https://gist.github.com/r00t-3xp10it/0c92cd554d3156fd74f6c25660ccc466 + +* https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/ + +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Slui spawning a process=== +The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, spawning a child process. This behavior is associated with publicly known UAC bypass. `slui.exe` is commonly associated with software updates and is most often spawned by `svchost.exe`. The `slui.exe` process should not have child processes, and any processes spawning from it will be running with elevated privileges. During triage, review the child process and additional parallel processes. Identify any file modifications that may have lead to the bypass. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548/002/ T1548.002] +* '''Last Updated''': 2021-05-13 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=slui.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `slui_spawning_a_process_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1548.002 +| Bypass User Account Control +| Defense Evasion, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Certain applications may spawn from `slui.exe` that are legitimate. Filtering will be needed to ensure proper monitoring. + +====Reference==== + + +* https://www.exploit-db.com/exploits/46998 + +* https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/ + +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log + + ''version'': 1
@@ -28039,6 +29499,182 @@ Using sc.exe to manipulate Windows services is uncommon. However, there may be l ---- +===Schedule task with http command arguments=== +The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/ T1053] +* '''Last Updated''': 2021-04-19 + +
+
+ +====Search==== +`wineventlog_security` EventCode=4698 +| xmlkv Message +| search Arguments IN ("*http*") +| stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `schedule_task_with_http_command_arguments_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. + +====Required field==== + +* _time + +* dest + +* Task_Name + +* Command + +* Author + +* Enabled + +* Hidden + +* Arguments + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1053 +| Scheduled Task/Job +| Execution, Persistence, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log + + +''version'': 1 +
+
+ +---- + +===Schedule task with rundll32 command trigger=== +The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/ T1053] +* '''Last Updated''': 2021-04-19 + +
+
+ +====Search==== +`wineventlog_security` EventCode=4698 +| xmlkv Message +| search Command IN ("*rundll32*") +| stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `schedule_task_with_rundll32_command_trigger_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]] + +* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. + +====Required field==== + +* _time + +* dest + +* Task_Name + +* Command + +* Author + +* Enabled + +* Hidden + +* Arguments + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1053 +| Scheduled Task/Job +| Execution, Persistence, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://labs.vipre.com/trickbot-and-its-modules/ + +* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log + + +''version'': 1 +
+
+ +---- + ===Scheduled task deleted or created via cmd=== This search looks for flags passed to schtasks.exe on the command-line that indicate a task was created via command like. This has been associated with the Dragonfly threat actor, and the SUNBURST attack against Solarwinds. @@ -28780,92 +30416,6 @@ None identified. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log -''version'': 1 - - - ----- - -===Shedule task with http command arguments=== -The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine.\ The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' - -* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/ T1053] -* '''Last Updated''': 2021-04-19 - -
-
- -====Search==== -`wineventlog_security` EventCode=4698 -| xmlkv Message -| search Arguments IN ("*http*") -| stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `shedule_task_with_http_command_arguments_filter` - -====Associated Analytic Story==== - -* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]] - - -====How To Implement==== -To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment. - -====Required field==== - -* _time - -* dest - -* Task_Name - -* Command - -* Author - -* Enabled - -* Hidden - -* Arguments - - - -====ATT&CK==== -{| -! style="text-align:left;"| ID -! Technique -! Tactic -|- -| T1053 -| Scheduled Task/Job -| Execution, Persistence, Privilege Escalation -|} - - -====Kill Chain Phase==== - -* Exploitation - - -====Known False Positives==== -unknown - -====Reference==== - - -* https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ - - - -====Test Dataset==== - -* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log - - ''version'': 1
@@ -30256,6 +31806,8 @@ The following analytic identifies rundll32.exe executing a DLL function name, St * [[Documentation:ESSOC:stories:UseCase#Cobalt_Strike|Cobalt Strike]] +* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]] + ====How To Implement==== To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -31522,7 +33074,6 @@ $cond_6 = | union $cond_4 | union $cond_5 | union $cond_6 -| | where process_path NOT LIKE "%\\windows\\system32%" OR process_path NOT LIKE "%\\windows\\syswow64%" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user), body=create_map(["process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events(); @@ -31681,6 +33232,92 @@ This detection may require tuning based on third party applications utilizing na ---- +===Trickbot named pipe=== +this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1055/ T1055] +* '''Last Updated''': 2021-04-26 + +
+
+ +====Search==== +`sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" +| stats min(_time) as firstTime max(_time) as lastTime count by Computer user_id EventCode PipeName signature Image process_id +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `trickbot_named_pipe_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. . + +====Required field==== + +* _time + +* Computer + +* user_id + +* EventCode + +* PipeName + +* signature + +* Image + +* process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1055 +| Process Injection +| Defense Evasion, Privilege Escalation +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://labs.vipre.com/trickbot-and-its-modules/ + +* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===Usn journal deletion=== The fsutil.exe application is a legitimate Windows utility used to perform tasks related to the file allocation table (FAT) and NTFS file systems. The update sequence number (USN) change journal provides a log of all changes made to the files on the disk. This search looks for fsutil.exe deleting the USN journal. @@ -32545,6 +34182,267 @@ Some software may create WMI temporary event subscriptions for various purposes. ====Test Dataset==== +''version'': 1 + + + +---- + +===Wermgr process connecting to ip check web services=== +this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1590/005/ T1590.005] +* '''Last Updated''': 2021-04-19 + +
+
+ +====Search==== +`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") +| stats min(_time) as firstTime max(_time) as lastTime count by process_path process_name process_id QueryName QueryStatus QueryResults Computer EventCode +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `wermgr_process_connecting_to_ip_check_web_services_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA. + +====Required field==== + +* _time + +* process_path + +* process_name + +* process_id + +* QueryName + +* QueryStatus + +* QueryResults + +* Computer + +* EventCode + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1590.005 +| IP Addresses +| Reconnaissance +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://labs.vipre.com/trickbot-and-its-modules/ + +* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Wermgr process create executable file=== +this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop executable file. This technique is commonly seen in trickbot malware where it injects it code to this process to execute it malicious behavior like downloading other payload + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1027/ T1027] +* '''Last Updated''': 2021-04-19 + +
+
+ +====Search==== +`sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe" +| stats min(_time) as firstTime max(_time) as lastTime count by Image TargetFilename process_name dest EventCode ProcessId +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `wermgr_process_create_executable_file_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of wermgr.exe may be used. + +====Required field==== + +* _time + +* Image + +* TargetFilename + +* process_name + +* dest + +* EventCode + +* ProcessId + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1027 +| Obfuscated Files or Information +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://labs.vipre.com/trickbot-and-its-modules/ + +* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Wermgr process spawned cmd or powershell process=== +This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059] +* '''Last Updated''': 2021-04-19 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` values(Processes.process) as cmdline min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe" OR Processes.process_name = "powershell.exe" by Processes.parent_process_name Processes.parent_process_id Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `wermgr_process_spawned_cmd_or_powershell_process_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* Processes.parent_process_name + +* Processes.parent_process_id + +* Processes.process_name + +* Processes.process + +* Processes.process_id + +* Processes.process_guid + +* Processes.dest + +* Processes.user + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1059 +| Command and Scripting Interpreter +| Execution +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://labs.vipre.com/trickbot-and-its-modules/ + +* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log + + ''version'': 1
@@ -33313,6 +35211,177 @@ There will be limited false positives and it will be different for every environ * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_wsh.log +''version'': 1 + + + +---- + +===Write executable in smb share=== +This search is to detect suspicious dropping or creating an executable file in known sensitive SMB share. This technique is commonly used for lateral movement like how trickbot try to infect other machine in the infected network. This detection catch the access event (FILE WRITE) access to a share. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/002/ T1021.002] +* '''Last Updated''': 2021-04-23 + +
+
+ +====Search==== +`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" +| stats min(_time) as firstTime max(_time) as lastTime count by EventCode Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `write_executable_in_smb_share_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. + +====Required field==== + +* _time + +* EventCode + +* Share_Name + +* Relative_Target_Name + +* Object_Type + +* Access_Mask + +* user + +* src_port + +* Source_Address + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1021.002 +| SMB/Windows Admin Shares +| Lateral Movement +|} + + +====Kill Chain Phase==== + +* Lateral Movement + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://labs.vipre.com/trickbot-and-its-modules/ + +* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html + + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log + + +''version'': 1 +
+
+ +---- + + + +==Experimental== + + +===Delete shadowcopy with powershell=== +This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490] +* '''Last Updated''': 2021-05-12 + +
+
+ +====Search==== +`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `delete_shadowcopy_with_powershell_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. + +====Required field==== + +* _time + +* EventCode + +* Message + +* ComputerName + +* User + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1490 +| Inhibit System Recovery +| Impact +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html + +* https://searchwindowsserver.techtarget.com/tutorial/Set-up-PowerShell-script-block-logging-for-added-security + + + +====Test Dataset==== + + ''version'': 1
@@ -36215,7 +38284,7 @@ There might be false positives associted with this detection since items like ar 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
-# On Date: 2021-04-29 21:24:36.954653 UTC''
+# On Date: 2021-05-13 22:00:21.859290 UTC''
 # Author: Splunk Security Research''
 # Contact: research@splunk.com''
 #############
diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv
index 49cada9d02..04d042aacf 100644
--- a/docs/mitre-map/coverage.csv
+++ b/docs/mitre-map/coverage.csv
@@ -47,17 +47,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -69,7 +69,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -89,9 +89,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -99,10 +101,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -145,7 +148,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -226,11 +229,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -279,22 +283,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -307,14 +313,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -338,7 +345,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -405,10 +412,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -416,7 +423,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -444,15 +458,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -461,7 +476,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -570,8 +586,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -623,8 +639,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -638,8 +654,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -694,7 +710,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -733,8 +750,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -945,10 +962,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -1027,17 +1045,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -1049,7 +1067,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -1069,9 +1087,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -1079,10 +1099,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -1125,7 +1146,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -1206,11 +1227,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -1259,22 +1281,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -1287,14 +1311,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -1318,7 +1343,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -1385,10 +1410,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -1396,7 +1421,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -1424,15 +1456,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -1441,7 +1474,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -1550,8 +1584,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -1603,8 +1637,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -1618,8 +1652,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -1674,7 +1708,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -1713,8 +1748,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -1925,10 +1960,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -2007,17 +2043,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -2029,7 +2065,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -2049,9 +2085,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -2059,10 +2097,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -2105,7 +2144,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -2186,11 +2225,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -2239,22 +2279,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -2267,14 +2309,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -2298,7 +2341,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -2365,10 +2408,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -2376,7 +2419,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -2404,15 +2454,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -2421,7 +2472,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -2530,8 +2582,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -2583,8 +2635,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -2598,8 +2650,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -2654,7 +2706,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -2693,8 +2746,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -2905,10 +2958,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -2987,17 +3041,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -3009,7 +3063,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -3029,9 +3083,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -3039,10 +3095,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -3085,7 +3142,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -3166,11 +3223,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -3219,22 +3277,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -3247,14 +3307,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -3278,7 +3339,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -3345,10 +3406,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -3356,7 +3417,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -3384,15 +3452,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -3401,7 +3470,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -3510,8 +3580,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -3563,8 +3633,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -3578,8 +3648,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -3634,7 +3704,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -3673,8 +3744,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -3885,10 +3956,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -3967,17 +4039,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -3989,7 +4061,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -4009,9 +4081,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -4019,10 +4093,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -4065,7 +4140,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -4146,11 +4221,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -4199,22 +4275,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -4227,14 +4305,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -4258,7 +4337,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -4325,10 +4404,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -4336,7 +4415,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -4364,15 +4450,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -4381,7 +4468,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -4490,8 +4578,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -4543,8 +4631,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -4558,8 +4646,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -4614,7 +4702,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -4653,8 +4742,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -4865,10 +4954,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -4947,17 +5037,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -4969,7 +5059,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -4989,9 +5079,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -4999,10 +5091,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -5045,7 +5138,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -5126,11 +5219,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -5179,22 +5273,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -5207,14 +5303,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -5238,7 +5335,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -5305,10 +5402,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -5316,7 +5413,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -5344,15 +5448,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -5361,7 +5466,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -5470,8 +5576,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -5523,8 +5629,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -5538,8 +5644,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -5594,7 +5700,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -5633,8 +5740,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -5845,10 +5952,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -5927,17 +6035,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -5949,7 +6057,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -5969,9 +6077,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -5979,10 +6089,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -6025,7 +6136,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -6106,11 +6217,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -6159,22 +6271,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -6187,14 +6301,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -6218,7 +6333,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -6285,10 +6400,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -6296,7 +6411,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -6324,15 +6446,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -6341,7 +6464,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -6450,8 +6574,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -6503,8 +6627,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -6518,8 +6642,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -6574,7 +6698,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -6613,8 +6738,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -6825,10 +6950,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -6907,17 +7033,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -6929,7 +7055,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -6949,9 +7075,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -6959,10 +7087,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -7005,7 +7134,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -7086,11 +7215,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -7139,22 +7269,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -7167,14 +7299,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -7198,7 +7331,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -7265,10 +7398,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -7276,7 +7409,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -7304,15 +7444,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -7321,7 +7462,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -7430,8 +7572,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -7483,8 +7625,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -7498,8 +7640,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -7554,7 +7696,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -7593,8 +7736,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -7805,10 +7948,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -7887,17 +8031,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -7909,7 +8053,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -7929,9 +8073,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -7939,10 +8085,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -7985,7 +8132,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -8066,11 +8213,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -8119,22 +8267,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -8147,14 +8297,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -8178,7 +8329,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -8245,10 +8396,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -8256,7 +8407,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -8284,15 +8442,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -8301,7 +8460,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -8410,8 +8570,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -8463,8 +8623,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -8478,8 +8638,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -8534,7 +8694,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -8573,8 +8734,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -8785,10 +8946,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -8867,17 +9029,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -8889,7 +9051,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -8909,9 +9071,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -8919,10 +9083,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -8965,7 +9130,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -9046,11 +9211,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -9099,22 +9265,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -9127,14 +9295,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -9158,7 +9327,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -9225,10 +9394,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -9236,7 +9405,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -9264,15 +9440,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -9281,7 +9458,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -9390,8 +9568,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -9443,8 +9621,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -9458,8 +9636,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -9514,7 +9692,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -9553,8 +9732,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -9765,10 +9944,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -9847,17 +10027,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -9869,7 +10049,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -9889,9 +10069,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -9899,10 +10081,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -9945,7 +10128,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -10026,11 +10209,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -10079,22 +10263,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -10107,14 +10293,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -10138,7 +10325,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -10205,10 +10392,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -10216,7 +10403,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -10244,15 +10438,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -10261,7 +10456,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -10370,8 +10566,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -10423,8 +10619,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -10438,8 +10634,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -10494,7 +10690,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -10533,8 +10730,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -10745,10 +10942,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -10827,17 +11025,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -10849,7 +11047,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -10869,9 +11067,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -10879,10 +11079,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -10925,7 +11126,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -11006,11 +11207,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -11059,22 +11261,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -11087,14 +11291,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -11118,7 +11323,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -11185,10 +11390,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -11196,7 +11401,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -11224,15 +11436,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -11241,7 +11454,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -11350,8 +11564,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -11403,8 +11617,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -11418,8 +11632,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -11474,7 +11688,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -11513,8 +11728,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -11725,10 +11940,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -11807,17 +12023,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -11829,7 +12045,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -11849,9 +12065,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -11859,10 +12077,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -11905,7 +12124,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -11986,11 +12205,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -12039,22 +12259,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -12067,14 +12289,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -12098,7 +12321,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -12165,10 +12388,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -12176,7 +12399,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -12204,15 +12434,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -12221,7 +12452,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -12330,8 +12562,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -12383,8 +12615,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -12398,8 +12630,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -12454,7 +12686,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -12493,8 +12726,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -12705,10 +12938,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -12787,17 +13021,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -12809,7 +13043,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -12829,9 +13063,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -12839,10 +13075,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -12885,7 +13122,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -12966,11 +13203,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -13019,22 +13257,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -13047,14 +13287,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -13078,7 +13319,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -13145,10 +13386,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -13156,7 +13397,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -13184,15 +13432,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -13201,7 +13450,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -13310,8 +13560,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -13363,8 +13613,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -13378,8 +13628,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -13434,7 +13684,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -13473,8 +13724,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -13685,10 +13936,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -13767,17 +14019,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -13789,7 +14041,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -13809,9 +14061,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -13819,10 +14073,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -13865,7 +14120,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -13946,11 +14201,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -13999,22 +14255,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -14027,14 +14285,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -14058,7 +14317,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -14125,10 +14384,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -14136,7 +14395,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -14164,15 +14430,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -14181,7 +14448,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -14290,8 +14558,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -14343,8 +14611,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -14358,8 +14626,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -14414,7 +14682,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -14453,8 +14722,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -14665,10 +14934,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -14747,17 +15017,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -14769,7 +15039,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -14789,9 +15059,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -14799,10 +15071,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -14845,7 +15118,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -14926,11 +15199,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -14979,22 +15253,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -15007,14 +15283,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -15038,7 +15315,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -15105,10 +15382,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -15116,7 +15393,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -15144,15 +15428,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -15161,7 +15446,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -15270,8 +15556,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -15323,8 +15609,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -15338,8 +15624,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -15394,7 +15680,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -15433,8 +15720,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -15645,10 +15932,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -15727,17 +16015,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -15749,7 +16037,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -15769,9 +16057,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -15779,10 +16069,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -15825,7 +16116,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -15906,11 +16197,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -15959,22 +16251,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -15987,14 +16281,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -16018,7 +16313,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -16085,10 +16380,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -16096,7 +16391,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -16124,15 +16426,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -16141,7 +16444,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -16250,8 +16554,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -16303,8 +16607,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -16318,8 +16622,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -16374,7 +16678,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -16413,8 +16718,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -16625,10 +16930,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -16707,17 +17013,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -16729,7 +17035,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -16749,9 +17055,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -16759,10 +17067,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -16805,7 +17114,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -16886,11 +17195,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -16939,22 +17249,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -16967,14 +17279,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -16998,7 +17311,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -17065,10 +17378,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -17076,7 +17389,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -17104,15 +17424,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -17121,7 +17442,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -17230,8 +17552,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -17283,8 +17605,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -17298,8 +17620,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -17354,7 +17676,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -17393,8 +17716,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -17605,10 +17928,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -17687,17 +18011,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -17709,7 +18033,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -17729,9 +18053,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -17739,10 +18065,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -17785,7 +18112,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -17866,11 +18193,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -17919,22 +18247,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -17947,14 +18277,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -17978,7 +18309,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -18045,10 +18376,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -18056,7 +18387,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -18084,15 +18422,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -18101,7 +18440,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -18210,8 +18550,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -18263,8 +18603,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -18278,8 +18618,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -18334,7 +18674,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -18373,8 +18714,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -18585,10 +18926,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -18667,17 +19009,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -18689,7 +19031,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -18709,9 +19051,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -18719,10 +19063,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -18765,7 +19110,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -18846,11 +19191,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -18899,22 +19245,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -18927,14 +19275,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -18958,7 +19307,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -19025,10 +19374,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -19036,7 +19385,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -19064,15 +19420,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -19081,7 +19438,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -19190,8 +19548,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -19243,8 +19601,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -19258,8 +19616,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -19314,7 +19672,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -19353,8 +19712,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -19565,10 +19924,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -19647,17 +20007,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -19669,7 +20029,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -19689,9 +20049,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -19699,10 +20061,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -19745,7 +20108,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -19826,11 +20189,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -19879,22 +20243,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -19907,14 +20273,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -19938,7 +20305,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -20005,10 +20372,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -20016,7 +20383,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -20044,15 +20418,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -20061,7 +20436,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -20170,8 +20546,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -20223,8 +20599,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -20238,8 +20614,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -20294,7 +20670,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -20333,8 +20710,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -20545,10 +20922,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -20627,17 +21005,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -20649,7 +21027,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -20669,9 +21047,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -20679,10 +21059,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -20725,7 +21106,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -20806,11 +21187,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -20859,22 +21241,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -20887,14 +21271,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -20918,7 +21303,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -20985,10 +21370,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -20996,7 +21381,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -21024,15 +21416,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -21041,7 +21434,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -21150,8 +21544,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -21203,8 +21597,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -21218,8 +21612,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -21274,7 +21668,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -21313,8 +21708,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -21525,10 +21920,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -21607,17 +22003,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -21629,7 +22025,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -21649,9 +22045,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -21659,10 +22057,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -21705,7 +22104,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -21786,11 +22185,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -21839,22 +22239,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -21867,14 +22269,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -21898,7 +22301,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -21965,10 +22368,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -21976,7 +22379,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -22004,15 +22414,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -22021,7 +22432,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -22130,8 +22542,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -22183,8 +22595,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -22198,8 +22610,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -22254,7 +22666,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -22293,8 +22706,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -22505,10 +22918,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -22587,17 +23001,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -22609,7 +23023,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -22629,9 +23043,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -22639,10 +23055,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -22685,7 +23102,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -22766,11 +23183,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -22819,22 +23237,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -22847,14 +23267,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -22878,7 +23299,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -22945,10 +23366,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -22956,7 +23377,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -22984,15 +23412,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -23001,7 +23430,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -23110,8 +23540,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -23163,8 +23593,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -23178,8 +23608,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -23234,7 +23664,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -23273,8 +23704,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -23485,10 +23916,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -23567,17 +23999,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -23589,7 +24021,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -23609,9 +24041,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -23619,10 +24053,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -23665,7 +24100,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -23746,11 +24181,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -23799,22 +24235,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -23827,14 +24265,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -23858,7 +24297,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -23925,10 +24364,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -23936,7 +24375,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -23964,15 +24410,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -23981,7 +24428,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -24090,8 +24538,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -24143,8 +24591,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -24158,8 +24606,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -24214,7 +24662,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -24253,8 +24702,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -24465,10 +24914,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -24547,17 +24997,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -24569,7 +25019,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -24589,9 +25039,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -24599,10 +25051,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -24645,7 +25098,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -24726,11 +25179,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -24779,22 +25233,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -24807,14 +25263,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -24838,7 +25295,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -24905,10 +25362,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -24916,7 +25373,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -24944,15 +25408,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -24961,7 +25426,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -25070,8 +25536,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -25123,8 +25589,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -25138,8 +25604,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -25194,7 +25660,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -25233,8 +25700,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -25445,10 +25912,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -25527,17 +25995,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -25549,7 +26017,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -25569,9 +26037,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -25579,10 +26049,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -25625,7 +26096,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -25706,11 +26177,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -25759,22 +26231,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -25787,14 +26261,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -25818,7 +26293,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -25885,10 +26360,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -25896,7 +26371,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -25924,15 +26406,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -25941,7 +26424,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -26050,8 +26534,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -26103,8 +26587,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -26118,8 +26602,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -26174,7 +26658,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -26213,8 +26698,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -26425,10 +26910,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -26507,17 +26993,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -26529,7 +27015,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -26549,9 +27035,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -26559,10 +27047,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -26605,7 +27094,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -26686,11 +27175,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -26739,22 +27229,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -26767,14 +27259,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -26798,7 +27291,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -26865,10 +27358,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -26876,7 +27369,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -26904,15 +27404,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -26921,7 +27422,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -27030,8 +27532,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -27083,8 +27585,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -27098,8 +27600,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -27154,7 +27656,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -27193,8 +27696,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -27405,10 +27908,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -27487,17 +27991,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -27509,7 +28013,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -27529,9 +28033,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -27539,10 +28045,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -27585,7 +28092,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -27666,11 +28173,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -27719,22 +28227,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -27747,14 +28257,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -27778,7 +28289,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -27845,10 +28356,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -27856,7 +28367,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -27884,15 +28402,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -27901,7 +28420,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -28010,8 +28530,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -28063,8 +28583,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -28078,8 +28598,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -28134,7 +28654,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -28173,8 +28694,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -28385,10 +28906,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -28467,17 +28989,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -28489,7 +29011,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -28509,9 +29031,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -28519,10 +29043,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -28565,7 +29090,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -28646,11 +29171,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -28699,22 +29225,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -28727,14 +29255,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -28758,7 +29287,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -28825,10 +29354,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -28836,7 +29365,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -28864,15 +29400,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -28881,7 +29418,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -28990,8 +29528,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -29043,8 +29581,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -29058,8 +29596,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -29114,7 +29652,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -29153,8 +29692,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -29365,10 +29904,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -29447,17 +29987,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -29469,7 +30009,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -29489,9 +30029,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -29499,10 +30041,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -29545,7 +30088,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -29626,11 +30169,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -29679,22 +30223,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -29707,14 +30253,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -29738,7 +30285,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -29805,10 +30352,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -29816,7 +30363,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -29844,15 +30398,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -29861,7 +30416,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -29970,8 +30526,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -30023,8 +30579,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -30038,8 +30594,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -30094,7 +30650,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -30133,8 +30690,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -30345,10 +30902,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -30427,17 +30985,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -30449,7 +31007,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -30469,9 +31027,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -30479,10 +31039,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -30525,7 +31086,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -30606,11 +31167,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -30659,22 +31221,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -30687,14 +31251,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -30718,7 +31283,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -30785,10 +31350,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -30796,7 +31361,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -30824,15 +31396,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -30841,7 +31414,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -30950,8 +31524,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -31003,8 +31577,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -31018,8 +31592,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -31074,7 +31648,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -31113,8 +31688,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -31325,10 +31900,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -31407,17 +31983,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -31429,7 +32005,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -31449,9 +32025,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -31459,10 +32037,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -31505,7 +32084,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -31586,11 +32165,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -31639,22 +32219,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -31667,14 +32249,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -31698,7 +32281,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -31765,10 +32348,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -31776,7 +32359,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -31804,15 +32394,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -31821,7 +32412,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -31930,8 +32522,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -31983,8 +32575,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -31998,8 +32590,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -32054,7 +32646,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -32093,8 +32686,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -32305,10 +32898,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -32387,17 +32981,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -32409,7 +33003,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -32429,9 +33023,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -32439,10 +33035,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -32485,7 +33082,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -32566,11 +33163,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -32619,22 +33217,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -32647,14 +33247,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -32678,7 +33279,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -32745,10 +33346,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -32756,7 +33357,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -32784,15 +33392,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -32801,7 +33410,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -32910,8 +33520,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -32963,8 +33573,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -32978,8 +33588,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -33034,7 +33644,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -33073,8 +33684,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -33285,10 +33896,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -33367,17 +33979,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -33389,7 +34001,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -33409,9 +34021,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -33419,10 +34033,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -33465,7 +34080,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -33546,11 +34161,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -33599,22 +34215,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -33627,14 +34245,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -33658,7 +34277,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -33725,10 +34344,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -33736,7 +34355,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -33764,15 +34390,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -33781,7 +34408,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -33890,8 +34518,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -33943,8 +34571,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -33958,8 +34586,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -34014,7 +34642,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -34053,8 +34682,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -34265,10 +34894,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -34347,17 +34977,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -34369,7 +34999,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -34389,9 +35019,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -34399,10 +35031,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -34445,7 +35078,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -34526,11 +35159,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -34579,22 +35213,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -34607,14 +35243,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -34638,7 +35275,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -34705,10 +35342,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -34716,7 +35353,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -34744,15 +35388,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -34761,7 +35406,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -34870,8 +35516,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -34923,8 +35569,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -34938,8 +35584,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -34994,7 +35640,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -35033,8 +35680,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -35245,10 +35892,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -35327,17 +35975,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -35349,7 +35997,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -35369,9 +36017,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -35379,10 +36029,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -35425,7 +36076,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -35506,11 +36157,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -35559,22 +36211,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -35587,14 +36241,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -35618,7 +36273,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -35685,10 +36340,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -35696,7 +36351,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -35724,15 +36386,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -35741,7 +36404,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -35850,8 +36514,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -35903,8 +36567,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -35918,8 +36582,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -35974,7 +36638,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -36013,8 +36678,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -36225,10 +36890,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -36307,17 +36973,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -36329,7 +36995,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -36349,9 +37015,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -36359,10 +37027,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -36405,7 +37074,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -36486,11 +37155,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -36539,22 +37209,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -36567,14 +37239,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -36598,7 +37271,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -36665,10 +37338,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -36676,7 +37349,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -36704,15 +37384,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -36721,7 +37402,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -36830,8 +37512,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -36883,8 +37565,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -36898,8 +37580,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -36954,7 +37636,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -36993,8 +37676,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -37205,10 +37888,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -37287,17 +37971,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -37309,7 +37993,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -37329,9 +38013,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -37339,10 +38025,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -37385,7 +38072,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -37466,11 +38153,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -37519,22 +38207,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -37547,14 +38237,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -37578,7 +38269,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -37645,10 +38336,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -37656,7 +38347,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -37684,15 +38382,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -37701,7 +38400,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -37810,8 +38510,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -37863,8 +38563,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -37878,8 +38578,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -37934,7 +38634,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -37973,8 +38674,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -38185,10 +38886,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -38267,17 +38969,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -38289,7 +38991,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -38309,9 +39011,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -38319,10 +39023,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -38365,7 +39070,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -38446,11 +39151,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -38499,22 +39205,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -38527,14 +39235,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -38558,7 +39267,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -38625,10 +39334,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -38636,7 +39345,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -38664,15 +39380,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -38681,7 +39398,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -38790,8 +39508,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -38843,8 +39561,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -38858,8 +39576,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -38914,7 +39632,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -38953,8 +39672,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -39165,10 +39884,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -39247,17 +39967,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -39269,7 +39989,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -39289,9 +40009,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -39299,10 +40021,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -39345,7 +40068,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -39426,11 +40149,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -39479,22 +40203,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -39507,14 +40233,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -39538,7 +40265,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -39605,10 +40332,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -39616,7 +40343,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -39644,15 +40378,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -39661,7 +40396,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -39770,8 +40506,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -39823,8 +40559,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -39838,8 +40574,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -39894,7 +40630,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -39933,8 +40670,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -40145,10 +40882,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -40227,17 +40965,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -40249,7 +40987,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -40269,9 +41007,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -40279,10 +41019,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -40325,7 +41066,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -40406,11 +41147,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -40459,22 +41201,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -40487,14 +41231,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -40518,7 +41263,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -40585,10 +41330,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -40596,7 +41341,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -40624,15 +41376,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -40641,7 +41394,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -40750,8 +41504,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -40803,8 +41557,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -40818,8 +41572,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -40874,7 +41628,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -40913,8 +41668,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -41125,10 +41880,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -41207,17 +41963,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -41229,7 +41985,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -41249,9 +42005,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -41259,10 +42017,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -41305,7 +42064,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -41386,11 +42145,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -41439,22 +42199,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -41467,14 +42229,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -41498,7 +42261,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -41565,10 +42328,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -41576,7 +42339,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -41604,15 +42374,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -41621,7 +42392,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -41730,8 +42502,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -41783,8 +42555,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -41798,8 +42570,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -41854,7 +42626,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -41893,8 +42666,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -42105,10 +42878,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -42187,17 +42961,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -42209,7 +42983,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -42229,9 +43003,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -42239,10 +43015,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -42285,7 +43062,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -42366,11 +43143,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -42419,22 +43197,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -42447,14 +43227,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -42478,7 +43259,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -42545,10 +43326,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -42556,7 +43337,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -42584,15 +43372,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -42601,7 +43390,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -42710,8 +43500,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -42763,8 +43553,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -42778,8 +43568,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -42834,7 +43624,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -42873,8 +43664,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -43085,10 +43876,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -43167,17 +43959,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -43189,7 +43981,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -43209,9 +44001,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -43219,10 +44013,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -43265,7 +44060,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -43346,11 +44141,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -43399,22 +44195,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -43427,14 +44225,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -43458,7 +44257,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -43525,10 +44324,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -43536,7 +44335,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -43564,15 +44370,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -43581,7 +44388,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -43690,8 +44498,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -43743,8 +44551,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -43758,8 +44566,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -43814,7 +44622,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -43853,8 +44662,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -44065,10 +44874,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -44147,17 +44957,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -44169,7 +44979,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -44189,9 +44999,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -44199,10 +45011,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -44245,7 +45058,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -44326,11 +45139,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -44379,22 +45193,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -44407,14 +45223,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -44438,7 +45255,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -44505,10 +45322,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -44516,7 +45333,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -44544,15 +45368,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -44561,7 +45386,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -44670,8 +45496,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -44723,8 +45549,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -44738,8 +45564,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -44794,7 +45620,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -44833,8 +45660,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -45045,10 +45872,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -45127,17 +45955,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -45149,7 +45977,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -45169,9 +45997,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -45179,10 +46009,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -45225,7 +46056,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -45306,11 +46137,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -45359,22 +46191,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -45387,14 +46221,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -45418,7 +46253,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -45485,10 +46320,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -45496,7 +46331,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -45524,15 +46366,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -45541,7 +46384,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -45650,8 +46494,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -45703,8 +46547,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -45718,8 +46562,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -45774,7 +46618,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -45813,8 +46658,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -46025,10 +46870,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -46107,17 +46953,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -46129,7 +46975,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -46149,9 +46995,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -46159,10 +47007,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -46205,7 +47054,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -46286,11 +47135,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -46339,22 +47189,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -46367,14 +47219,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -46398,7 +47251,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -46465,10 +47318,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -46476,7 +47329,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -46504,15 +47364,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -46521,7 +47382,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -46630,8 +47492,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -46683,8 +47545,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -46698,8 +47560,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -46754,7 +47616,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -46793,8 +47656,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -47005,10 +47868,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -47087,17 +47951,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -47109,7 +47973,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -47129,9 +47993,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -47139,10 +48005,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -47185,7 +48052,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -47266,11 +48133,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -47319,22 +48187,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -47347,14 +48217,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -47378,7 +48249,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -47445,10 +48316,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -47456,7 +48327,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -47484,15 +48362,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -47501,7 +48380,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -47610,8 +48490,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -47663,8 +48543,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -47678,8 +48558,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -47734,7 +48614,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -47773,8 +48654,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -47985,10 +48866,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -48067,17 +48949,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -48089,7 +48971,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -48109,9 +48991,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -48119,10 +49003,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -48165,7 +49050,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -48246,11 +49131,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -48299,22 +49185,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -48327,14 +49215,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -48358,7 +49247,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -48425,10 +49314,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -48436,7 +49325,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -48464,15 +49360,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -48481,7 +49378,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -48590,8 +49488,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -48643,8 +49541,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -48658,8 +49556,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -48714,7 +49612,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -48753,8 +49652,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -48965,10 +49864,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -49047,17 +49947,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -49069,7 +49969,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -49089,9 +49989,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -49099,10 +50001,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -49145,7 +50048,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -49226,11 +50129,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -49279,22 +50183,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -49307,14 +50213,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -49338,7 +50245,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -49405,10 +50312,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -49416,7 +50323,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -49444,15 +50358,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -49461,7 +50376,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -49570,8 +50486,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -49623,8 +50539,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -49638,8 +50554,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -49694,7 +50610,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -49733,8 +50650,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -49945,10 +50862,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -50027,17 +50945,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -50049,7 +50967,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -50069,9 +50987,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -50079,10 +50999,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -50125,7 +51046,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -50206,11 +51127,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -50259,22 +51181,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -50287,14 +51211,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -50318,7 +51243,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -50385,10 +51310,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -50396,7 +51321,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -50424,15 +51356,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -50441,7 +51374,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -50550,8 +51484,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -50603,8 +51537,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -50618,8 +51552,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -50674,7 +51608,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -50713,8 +51648,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -50925,10 +51860,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -51007,17 +51943,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -51029,7 +51965,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -51049,9 +51985,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -51059,10 +51997,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -51105,7 +52044,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -51186,11 +52125,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -51239,22 +52179,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -51267,14 +52209,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -51298,7 +52241,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -51365,10 +52308,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -51376,7 +52319,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -51404,15 +52354,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -51421,7 +52372,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -51530,8 +52482,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -51583,8 +52535,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -51598,8 +52550,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -51654,7 +52606,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -51693,8 +52646,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -51905,10 +52858,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -51987,17 +52941,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -52009,7 +52963,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -52029,9 +52983,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -52039,10 +52995,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -52085,7 +53042,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -52166,11 +53123,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -52219,22 +53177,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -52247,14 +53207,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -52278,7 +53239,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -52345,10 +53306,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -52356,7 +53317,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -52384,15 +53352,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -52401,7 +53370,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -52510,8 +53480,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -52563,8 +53533,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -52578,8 +53548,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -52634,7 +53604,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -52673,8 +53644,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -52885,10 +53856,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -52967,17 +53939,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -52989,7 +53961,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -53009,9 +53981,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -53019,10 +53993,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -53065,7 +54040,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -53146,11 +54121,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -53199,22 +54175,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -53227,14 +54205,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -53258,7 +54237,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -53325,10 +54304,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -53336,7 +54315,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -53364,15 +54350,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -53381,7 +54368,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -53490,8 +54478,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -53543,8 +54531,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -53558,8 +54546,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -53614,7 +54602,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -53653,8 +54642,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -53865,10 +54854,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -53947,17 +54937,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -53969,7 +54959,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -53989,9 +54979,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -53999,10 +54991,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -54045,7 +55038,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -54126,11 +55119,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -54179,22 +55173,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -54207,14 +55203,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -54238,7 +55235,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -54305,10 +55302,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -54316,7 +55313,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -54344,15 +55348,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -54361,7 +55366,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -54470,8 +55476,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -54523,8 +55529,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -54538,8 +55544,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -54594,7 +55600,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -54633,8 +55640,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -54845,10 +55852,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -54927,17 +55935,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -54949,7 +55957,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -54969,9 +55977,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -54979,10 +55989,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -55025,7 +56036,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -55106,11 +56117,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -55159,22 +56171,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -55187,14 +56201,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -55218,7 +56233,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -55285,10 +56300,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -55296,7 +56311,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -55324,15 +56346,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -55341,7 +56364,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -55450,8 +56474,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -55503,8 +56527,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -55518,8 +56542,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -55574,7 +56598,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -55613,8 +56638,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -55825,10 +56850,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -55907,17 +56933,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -55929,7 +56955,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -55949,9 +56975,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -55959,10 +56987,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -56005,7 +57034,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -56086,11 +57115,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -56139,22 +57169,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -56167,14 +57199,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -56198,7 +57231,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -56265,10 +57298,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -56276,7 +57309,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -56304,15 +57344,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -56321,7 +57362,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -56430,8 +57472,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -56483,8 +57525,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -56498,8 +57540,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -56554,7 +57596,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -56593,8 +57636,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -56805,10 +57848,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -56887,17 +57931,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -56909,7 +57953,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -56929,9 +57973,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -56939,10 +57985,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -56985,7 +58032,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -57066,11 +58113,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -57119,22 +58167,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -57147,14 +58197,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -57178,7 +58229,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -57245,10 +58296,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -57256,7 +58307,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -57284,15 +58342,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -57301,7 +58360,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -57410,8 +58470,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -57463,8 +58523,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -57478,8 +58538,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -57534,7 +58594,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -57573,8 +58634,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -57785,10 +58846,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -57867,17 +58929,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -57889,7 +58951,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -57909,9 +58971,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -57919,10 +58983,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -57965,7 +59030,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -58046,11 +59111,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -58099,22 +59165,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -58127,14 +59195,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -58158,7 +59227,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -58225,10 +59294,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -58236,7 +59305,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -58264,15 +59340,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -58281,7 +59358,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -58390,8 +59468,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -58443,8 +59521,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -58458,8 +59536,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -58514,7 +59592,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -58553,8 +59632,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -58765,10 +59844,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -58847,17 +59927,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -58869,7 +59949,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -58889,9 +59969,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -58899,10 +59981,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -58945,7 +60028,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -59026,11 +60109,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -59079,22 +60163,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -59107,14 +60193,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -59138,7 +60225,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -59205,10 +60292,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -59216,7 +60303,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -59244,15 +60338,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -59261,7 +60356,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -59370,8 +60466,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -59423,8 +60519,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -59438,8 +60534,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -59494,7 +60590,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -59533,8 +60630,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -59745,10 +60842,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -59827,17 +60925,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -59849,7 +60947,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -59869,9 +60967,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -59879,10 +60979,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -59925,7 +61026,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -60006,11 +61107,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -60059,22 +61161,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -60087,14 +61191,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -60118,7 +61223,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -60185,10 +61290,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -60196,7 +61301,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -60224,15 +61336,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -60241,7 +61354,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -60350,8 +61464,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -60403,8 +61517,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -60418,8 +61532,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -60474,7 +61588,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -60513,8 +61628,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -60725,10 +61840,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -60807,17 +61923,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -60829,7 +61945,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -60849,9 +61965,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -60859,10 +61977,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -60905,7 +62024,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -60986,11 +62105,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -61039,22 +62159,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -61067,14 +62189,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -61098,7 +62221,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -61165,10 +62288,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -61176,7 +62299,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -61204,15 +62334,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -61221,7 +62352,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -61330,8 +62462,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -61383,8 +62515,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -61398,8 +62530,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -61454,7 +62586,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -61493,8 +62626,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -61705,10 +62838,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -61787,17 +62921,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -61809,7 +62943,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -61829,9 +62963,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -61839,10 +62975,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -61885,7 +63022,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -61966,11 +63103,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -62019,22 +63157,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -62047,14 +63187,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -62078,7 +63219,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -62145,10 +63286,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -62156,7 +63297,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -62184,15 +63332,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -62201,7 +63350,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -62310,8 +63460,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -62363,8 +63513,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -62378,8 +63528,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -62434,7 +63584,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -62473,8 +63624,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -62685,10 +63836,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -62767,17 +63919,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -62789,7 +63941,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -62809,9 +63961,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -62819,10 +63973,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -62865,7 +64020,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -62946,11 +64101,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -62999,22 +64155,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -63027,14 +64185,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -63058,7 +64217,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -63125,10 +64284,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -63136,7 +64295,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -63164,15 +64330,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -63181,7 +64348,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -63290,8 +64458,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -63343,8 +64511,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -63358,8 +64526,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -63414,7 +64582,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -63453,8 +64622,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -63665,10 +64834,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -63747,17 +64917,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -63769,7 +64939,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -63789,9 +64959,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -63799,10 +64971,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -63845,7 +65018,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -63926,11 +65099,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -63979,22 +65153,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -64007,14 +65183,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -64038,7 +65215,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -64105,10 +65282,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -64116,7 +65293,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -64144,15 +65328,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -64161,7 +65346,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -64270,8 +65456,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -64323,8 +65509,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -64338,8 +65524,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -64394,7 +65580,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -64433,8 +65620,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -64645,10 +65832,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -64727,17 +65915,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -64749,7 +65937,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -64769,9 +65957,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -64779,10 +65969,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -64825,7 +66016,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -64906,11 +66097,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -64959,22 +66151,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -64987,14 +66181,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -65018,7 +66213,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -65085,10 +66280,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -65096,7 +66291,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -65124,15 +66326,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -65141,7 +66344,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -65250,8 +66454,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -65303,8 +66507,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -65318,8 +66522,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -65374,7 +66578,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -65413,8 +66618,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -65625,10 +66830,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -65707,17 +66913,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -65729,7 +66935,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -65749,9 +66955,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -65759,10 +66967,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -65805,7 +67014,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -65886,11 +67095,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -65939,22 +67149,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -65967,14 +67179,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -65998,7 +67211,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -66065,10 +67278,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -66076,7 +67289,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -66104,15 +67324,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -66121,7 +67342,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -66230,8 +67452,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -66283,8 +67505,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -66298,8 +67520,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -66354,7 +67576,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -66393,8 +67616,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -66605,10 +67828,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -66687,17 +67911,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -66709,7 +67933,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -66729,9 +67953,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -66739,10 +67965,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -66785,7 +68012,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -66866,11 +68093,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -66919,22 +68147,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -66947,14 +68177,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -66978,7 +68209,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -67045,10 +68276,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -67056,7 +68287,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -67084,15 +68322,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -67101,7 +68340,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -67210,8 +68450,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -67263,8 +68503,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -67278,8 +68518,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -67334,7 +68574,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -67373,8 +68614,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -67585,10 +68826,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -67667,17 +68909,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -67689,7 +68931,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -67709,9 +68951,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -67719,10 +68963,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -67765,7 +69010,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -67846,11 +69091,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -67899,22 +69145,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -67927,14 +69175,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -67958,7 +69207,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -68025,10 +69274,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -68036,7 +69285,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -68064,15 +69320,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -68081,7 +69338,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -68190,8 +69448,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -68243,8 +69501,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -68258,8 +69516,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -68314,7 +69572,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -68353,8 +69612,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -68565,10 +69824,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -68647,17 +69907,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -68669,7 +69929,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -68689,9 +69949,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -68699,10 +69961,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -68745,7 +70008,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -68826,11 +70089,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -68879,22 +70143,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -68907,14 +70173,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -68938,7 +70205,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -69005,10 +70272,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -69016,7 +70283,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -69044,15 +70318,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -69061,7 +70336,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -69170,8 +70446,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -69223,8 +70499,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -69238,8 +70514,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -69294,7 +70570,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -69333,8 +70610,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -69545,10 +70822,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -69627,17 +70905,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -69649,7 +70927,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -69669,9 +70947,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -69679,10 +70959,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -69725,7 +71006,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -69806,11 +71087,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -69859,22 +71141,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -69887,14 +71171,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -69918,7 +71203,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -69985,10 +71270,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -69996,7 +71281,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -70024,15 +71316,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -70041,7 +71334,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -70150,8 +71444,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -70203,8 +71497,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -70218,8 +71512,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -70274,7 +71568,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -70313,8 +71608,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -70525,10 +71820,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -70607,17 +71903,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -70629,7 +71925,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -70649,9 +71945,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -70659,10 +71957,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -70705,7 +72004,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -70786,11 +72085,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -70839,22 +72139,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -70867,14 +72169,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -70898,7 +72201,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -70965,10 +72268,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -70976,7 +72279,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -71004,15 +72314,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -71021,7 +72332,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -71130,8 +72442,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -71183,8 +72495,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -71198,8 +72510,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -71254,7 +72566,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -71293,8 +72606,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -71505,10 +72818,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -71587,17 +72901,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -71609,7 +72923,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -71629,9 +72943,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -71639,10 +72955,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -71685,7 +73002,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -71766,11 +73083,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -71819,22 +73137,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -71847,14 +73167,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -71878,7 +73199,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -71945,10 +73266,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -71956,7 +73277,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -71984,15 +73312,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -72001,7 +73330,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -72110,8 +73440,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -72163,8 +73493,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -72178,8 +73508,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -72234,7 +73564,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -72273,8 +73604,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -72485,10 +73816,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -72567,17 +73899,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -72589,7 +73921,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -72609,9 +73941,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -72619,10 +73953,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -72665,7 +74000,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -72746,11 +74081,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -72799,22 +74135,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -72827,14 +74165,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -72858,7 +74197,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -72925,10 +74264,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -72936,7 +74275,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -72964,15 +74310,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -72981,7 +74328,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -73090,8 +74438,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -73143,8 +74491,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -73158,8 +74506,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -73214,7 +74562,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -73253,8 +74602,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -73465,10 +74814,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -73547,17 +74897,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -73569,7 +74919,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -73589,9 +74939,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -73599,10 +74951,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -73645,7 +74998,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -73726,11 +75079,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -73779,22 +75133,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -73807,14 +75163,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -73838,7 +75195,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -73905,10 +75262,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -73916,7 +75273,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -73944,15 +75308,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -73961,7 +75326,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -74070,8 +75436,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -74123,8 +75489,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -74138,8 +75504,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -74194,7 +75560,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -74233,8 +75600,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -74445,10 +75812,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -74527,17 +75895,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -74549,7 +75917,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -74569,9 +75937,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -74579,10 +75949,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -74625,7 +75996,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -74706,11 +76077,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -74759,22 +76131,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -74787,14 +76161,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -74818,7 +76193,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -74885,10 +76260,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -74896,7 +76271,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -74924,15 +76306,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -74941,7 +76324,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -75050,8 +76434,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -75103,8 +76487,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -75118,8 +76502,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -75174,7 +76558,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -75213,8 +76598,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -75425,10 +76810,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -75507,17 +76893,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -75529,7 +76915,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -75549,9 +76935,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -75559,10 +76947,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -75605,7 +76994,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -75686,11 +77075,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -75739,22 +77129,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -75767,14 +77159,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -75798,7 +77191,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -75865,10 +77258,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -75876,7 +77269,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -75904,15 +77304,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -75921,7 +77322,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -76030,8 +77432,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -76083,8 +77485,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -76098,8 +77500,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -76154,7 +77556,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -76193,8 +77596,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -76405,10 +77808,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -76487,17 +77891,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -76509,7 +77913,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -76529,9 +77933,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -76539,10 +77945,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -76585,7 +77992,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -76666,11 +78073,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -76719,22 +78127,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -76747,14 +78157,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -76778,7 +78189,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -76845,10 +78256,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -76856,7 +78267,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -76884,15 +78302,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -76901,7 +78320,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -77010,8 +78430,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -77063,8 +78483,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -77078,8 +78498,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -77134,7 +78554,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -77173,8 +78594,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -77385,10 +78806,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -77467,17 +78889,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -77489,7 +78911,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -77509,9 +78931,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -77519,10 +78943,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -77565,7 +78990,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -77646,11 +79071,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -77699,22 +79125,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -77727,14 +79155,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -77758,7 +79187,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -77825,10 +79254,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -77836,7 +79265,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -77864,15 +79300,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -77881,7 +79318,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -77990,8 +79428,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -78043,8 +79481,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -78058,8 +79496,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -78114,7 +79552,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -78153,8 +79592,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -78365,10 +79804,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -78447,17 +79887,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -78469,7 +79909,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -78489,9 +79929,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -78499,10 +79941,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -78545,7 +79988,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -78626,11 +80069,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -78679,22 +80123,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -78707,14 +80153,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -78738,7 +80185,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -78805,10 +80252,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -78816,7 +80263,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -78844,15 +80298,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -78861,7 +80316,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -78970,8 +80426,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -79023,8 +80479,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -79038,8 +80494,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -79094,7 +80550,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -79133,8 +80590,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -79345,10 +80802,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -79427,17 +80885,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -79449,7 +80907,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -79469,9 +80927,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -79479,10 +80939,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -79525,7 +80986,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -79606,11 +81067,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -79659,22 +81121,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -79687,14 +81151,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -79718,7 +81183,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -79785,10 +81250,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -79796,7 +81261,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -79824,15 +81296,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -79841,7 +81314,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -79950,8 +81424,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -80003,8 +81477,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -80018,8 +81492,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -80074,7 +81548,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -80113,8 +81588,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -80325,10 +81800,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -80407,17 +81883,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -80429,7 +81905,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -80449,9 +81925,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -80459,10 +81937,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -80505,7 +81984,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -80586,11 +82065,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -80639,22 +82119,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -80667,14 +82149,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -80698,7 +82181,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -80765,10 +82248,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -80776,7 +82259,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -80804,15 +82294,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -80821,7 +82312,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -80930,8 +82422,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -80983,8 +82475,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -80998,8 +82490,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -81054,7 +82546,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -81093,8 +82586,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -81305,10 +82798,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -81387,17 +82881,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -81409,7 +82903,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -81429,9 +82923,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -81439,10 +82935,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -81485,7 +82982,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -81566,11 +83063,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -81619,22 +83117,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -81647,14 +83147,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -81678,7 +83179,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -81745,10 +83246,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -81756,7 +83257,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -81784,15 +83292,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -81801,7 +83310,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -81910,8 +83420,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -81963,8 +83473,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -81978,8 +83488,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -82034,7 +83544,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -82073,8 +83584,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -82285,10 +83796,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -82367,17 +83879,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -82389,7 +83901,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -82409,9 +83921,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -82419,10 +83933,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -82465,7 +83980,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -82546,11 +84061,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -82599,22 +84115,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -82627,14 +84145,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -82658,7 +84177,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -82725,10 +84244,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -82736,7 +84255,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -82764,15 +84290,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -82781,7 +84308,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -82890,8 +84418,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -82943,8 +84471,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -82958,8 +84486,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -83014,7 +84542,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -83053,8 +84582,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -83265,10 +84794,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -83347,17 +84877,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -83369,7 +84899,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -83389,9 +84919,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -83399,10 +84931,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -83445,7 +84978,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -83526,11 +85059,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -83579,22 +85113,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -83607,14 +85143,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -83638,7 +85175,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -83705,10 +85242,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -83716,7 +85253,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -83744,15 +85288,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -83761,7 +85306,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -83870,8 +85416,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -83923,8 +85469,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -83938,8 +85484,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -83994,7 +85540,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -84033,8 +85580,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -84245,10 +85792,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -84327,17 +85875,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -84349,7 +85897,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -84369,9 +85917,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -84379,10 +85929,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -84425,7 +85976,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -84506,11 +86057,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -84559,22 +86111,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -84587,14 +86141,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -84618,7 +86173,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -84685,10 +86240,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -84696,7 +86251,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -84724,15 +86286,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -84741,7 +86304,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -84850,8 +86414,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -84903,8 +86467,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -84918,8 +86482,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -84974,7 +86538,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -85013,8 +86578,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -85225,10 +86790,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -85307,17 +86873,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -85329,7 +86895,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -85349,9 +86915,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -85359,10 +86927,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -85405,7 +86974,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -85486,11 +87055,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -85539,22 +87109,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -85567,14 +87139,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -85598,7 +87171,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -85665,10 +87238,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -85676,7 +87249,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -85704,15 +87284,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -85721,7 +87302,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -85830,8 +87412,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -85883,8 +87465,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -85898,8 +87480,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -85954,7 +87536,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -85993,8 +87576,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -86205,10 +87788,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -86287,17 +87871,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -86309,7 +87893,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -86329,9 +87913,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -86339,10 +87925,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -86385,7 +87972,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -86466,11 +88053,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -86519,22 +88107,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -86547,14 +88137,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -86578,7 +88169,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -86645,10 +88236,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -86656,7 +88247,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -86684,15 +88282,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -86701,7 +88300,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -86810,8 +88410,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -86863,8 +88463,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -86878,8 +88478,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -86934,7 +88534,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -86973,8 +88574,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -87185,10 +88786,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -87267,17 +88869,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -87289,7 +88891,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -87309,9 +88911,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -87319,10 +88923,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -87365,7 +88970,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -87446,11 +89051,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -87499,22 +89105,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -87527,14 +89135,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -87558,7 +89167,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -87625,10 +89234,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -87636,7 +89245,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -87664,15 +89280,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -87681,7 +89298,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -87790,8 +89408,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -87843,8 +89461,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -87858,8 +89476,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -87914,7 +89532,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -87953,8 +89572,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -88165,10 +89784,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -88247,17 +89867,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -88269,7 +89889,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -88289,9 +89909,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -88299,10 +89921,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -88345,7 +89968,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -88426,11 +90049,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -88479,22 +90103,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -88507,14 +90133,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -88538,7 +90165,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -88605,10 +90232,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -88616,7 +90243,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -88644,15 +90278,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -88661,7 +90296,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -88770,8 +90406,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -88823,8 +90459,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -88838,8 +90474,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -88894,7 +90530,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -88933,8 +90570,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -89145,10 +90782,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -89227,17 +90865,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -89249,7 +90887,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -89269,9 +90907,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -89279,10 +90919,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -89325,7 +90966,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -89406,11 +91047,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -89459,22 +91101,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -89487,14 +91131,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -89518,7 +91163,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -89585,10 +91230,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -89596,7 +91241,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -89624,15 +91276,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -89641,7 +91294,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -89750,8 +91404,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -89803,8 +91457,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -89818,8 +91472,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -89874,7 +91528,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -89913,8 +91568,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -90125,10 +91780,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -90207,17 +91863,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -90229,7 +91885,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -90249,9 +91905,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -90259,10 +91917,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -90305,7 +91964,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -90386,11 +92045,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -90439,22 +92099,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -90467,14 +92129,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -90498,7 +92161,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -90565,10 +92228,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -90576,7 +92239,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -90604,15 +92274,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -90621,7 +92292,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -90730,8 +92402,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -90783,8 +92455,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -90798,8 +92470,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -90854,7 +92526,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -90893,8 +92566,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -91105,10 +92778,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -91187,17 +92861,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -91209,7 +92883,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -91229,9 +92903,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -91239,10 +92915,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -91285,7 +92962,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -91366,11 +93043,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -91419,22 +93097,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -91447,14 +93127,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -91478,7 +93159,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -91545,10 +93226,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -91556,7 +93237,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -91584,15 +93272,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -91601,7 +93290,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -91710,8 +93400,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -91763,8 +93453,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -91778,8 +93468,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -91834,7 +93524,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -91873,8 +93564,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -92085,10 +93776,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -92167,17 +93859,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -92189,7 +93881,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -92209,9 +93901,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -92219,10 +93913,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -92265,7 +93960,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -92346,11 +94041,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -92399,22 +94095,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -92427,14 +94125,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -92458,7 +94157,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -92525,10 +94224,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -92536,7 +94235,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -92564,15 +94270,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -92581,7 +94288,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -92690,8 +94398,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -92743,8 +94451,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -92758,8 +94466,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -92814,7 +94522,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -92853,8 +94562,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -93065,10 +94774,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -93147,17 +94857,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -93169,7 +94879,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -93189,9 +94899,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -93199,10 +94911,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -93245,7 +94958,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -93326,11 +95039,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -93379,22 +95093,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -93407,14 +95123,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -93438,7 +95155,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -93505,10 +95222,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -93516,7 +95233,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -93544,15 +95268,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -93561,7 +95286,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -93670,8 +95396,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -93723,8 +95449,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -93738,8 +95464,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -93794,7 +95520,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -93833,8 +95560,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -94045,10 +95772,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -94127,17 +95855,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -94149,7 +95877,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -94169,9 +95897,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -94179,10 +95909,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -94225,7 +95956,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -94306,11 +96037,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -94359,22 +96091,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -94387,14 +96121,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -94418,7 +96153,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -94485,10 +96220,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -94496,7 +96231,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -94524,15 +96266,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -94541,7 +96284,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -94650,8 +96394,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -94703,8 +96447,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -94718,8 +96462,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -94774,7 +96518,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -94813,8 +96558,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -95025,10 +96770,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -95107,17 +96853,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -95129,7 +96875,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -95149,9 +96895,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -95159,10 +96907,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -95205,7 +96954,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -95286,11 +97035,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -95339,22 +97089,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -95367,14 +97119,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -95398,7 +97151,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -95465,10 +97218,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -95476,7 +97229,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -95504,15 +97264,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -95521,7 +97282,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -95630,8 +97392,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -95683,8 +97445,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -95698,8 +97460,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -95754,7 +97516,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -95793,8 +97556,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -96005,10 +97768,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -96087,17 +97851,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -96109,7 +97873,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -96129,9 +97893,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -96139,10 +97905,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -96185,7 +97952,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -96266,11 +98033,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -96319,22 +98087,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -96347,14 +98117,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -96378,7 +98149,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -96445,10 +98216,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -96456,7 +98227,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -96484,15 +98262,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -96501,7 +98280,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -96610,8 +98390,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -96663,8 +98443,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -96678,8 +98458,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -96734,7 +98514,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -96773,8 +98554,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -96985,10 +98766,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -97067,17 +98849,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -97089,7 +98871,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -97109,9 +98891,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -97119,10 +98903,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -97165,7 +98950,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -97246,11 +99031,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -97299,22 +99085,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -97327,14 +99115,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -97358,7 +99147,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -97425,10 +99214,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -97436,7 +99225,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -97464,15 +99260,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -97481,7 +99278,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -97590,8 +99388,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -97643,8 +99441,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -97658,8 +99456,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -97714,7 +99512,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -97753,8 +99552,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -97965,10 +99764,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -98047,17 +99847,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -98069,7 +99869,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -98089,9 +99889,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -98099,10 +99901,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -98145,7 +99948,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -98226,11 +100029,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -98279,22 +100083,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -98307,14 +100113,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -98338,7 +100145,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -98405,10 +100212,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -98416,7 +100223,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -98444,15 +100258,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -98461,7 +100276,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -98570,8 +100386,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -98623,8 +100439,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -98638,8 +100454,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -98694,7 +100510,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -98733,8 +100550,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -98945,10 +100762,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -99027,17 +100845,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -99049,7 +100867,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -99069,9 +100887,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -99079,10 +100899,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -99125,7 +100946,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -99206,11 +101027,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -99259,22 +101081,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -99287,14 +101111,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -99318,7 +101143,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -99385,10 +101210,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -99396,7 +101221,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -99424,15 +101256,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -99441,7 +101274,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -99550,8 +101384,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -99603,8 +101437,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -99618,8 +101452,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -99674,7 +101508,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -99713,8 +101548,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -99925,10 +101760,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -100007,17 +101843,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -100029,7 +101865,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -100049,9 +101885,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -100059,10 +101897,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -100105,7 +101944,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -100186,11 +102025,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -100239,22 +102079,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -100267,14 +102109,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -100298,7 +102141,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -100365,10 +102208,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -100376,7 +102219,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -100404,15 +102254,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -100421,7 +102272,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -100530,8 +102382,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -100583,8 +102435,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -100598,8 +102450,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -100654,7 +102506,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -100693,8 +102546,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -100905,10 +102758,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -100987,17 +102841,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -101009,7 +102863,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -101029,9 +102883,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -101039,10 +102895,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -101085,7 +102942,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -101166,11 +103023,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -101219,22 +103077,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -101247,14 +103107,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -101278,7 +103139,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -101345,10 +103206,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -101356,7 +103217,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -101384,15 +103252,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -101401,7 +103270,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -101510,8 +103380,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -101563,8 +103433,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -101578,8 +103448,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -101634,7 +103504,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -101673,8 +103544,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -101885,10 +103756,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -101967,17 +103839,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -101989,7 +103861,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -102009,9 +103881,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -102019,10 +103893,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -102065,7 +103940,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -102146,11 +104021,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -102199,22 +104075,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -102227,14 +104105,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -102258,7 +104137,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -102325,10 +104204,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -102336,7 +104215,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -102364,15 +104250,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -102381,7 +104268,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -102490,8 +104378,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -102543,8 +104431,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -102558,8 +104446,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -102614,7 +104502,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -102653,8 +104542,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -102865,10 +104754,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -102947,17 +104837,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -102969,7 +104859,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -102989,9 +104879,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -102999,10 +104891,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -103045,7 +104938,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -103126,11 +105019,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -103179,22 +105073,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -103207,14 +105103,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -103238,7 +105135,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -103305,10 +105202,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -103316,7 +105213,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -103344,15 +105248,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -103361,7 +105266,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -103470,8 +105376,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -103523,8 +105429,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -103538,8 +105444,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -103594,7 +105500,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -103633,8 +105540,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -103845,10 +105752,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -103927,17 +105835,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -103949,7 +105857,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -103969,9 +105877,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -103979,10 +105889,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -104025,7 +105936,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -104106,11 +106017,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -104159,22 +106071,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -104187,14 +106101,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -104218,7 +106133,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -104285,10 +106200,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -104296,7 +106211,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -104324,15 +106246,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -104341,7 +106264,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -104450,8 +106374,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -104503,8 +106427,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -104518,8 +106442,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -104574,7 +106498,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -104613,8 +106538,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -104825,10 +106750,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -104907,17 +106833,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -104929,7 +106855,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -104949,9 +106875,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -104959,10 +106887,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -105005,7 +106934,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -105086,11 +107015,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -105139,22 +107069,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -105167,14 +107099,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -105198,7 +107131,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -105265,10 +107198,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -105276,7 +107209,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -105304,15 +107244,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -105321,7 +107262,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -105430,8 +107372,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -105483,8 +107425,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -105498,8 +107440,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -105554,7 +107496,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -105593,8 +107536,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -105805,10 +107748,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -105887,17 +107831,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -105909,7 +107853,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -105929,9 +107873,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -105939,10 +107885,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -105985,7 +107932,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -106066,11 +108013,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -106119,22 +108067,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -106147,14 +108097,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -106178,7 +108129,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -106245,10 +108196,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -106256,7 +108207,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -106284,15 +108242,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -106301,7 +108260,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -106410,8 +108370,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -106463,8 +108423,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -106478,8 +108438,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -106534,7 +108494,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -106573,8 +108534,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -106785,10 +108746,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -106867,17 +108829,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -106889,7 +108851,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -106909,9 +108871,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -106919,10 +108883,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -106965,7 +108930,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -107046,11 +109011,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -107099,22 +109065,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -107127,14 +109095,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -107158,7 +109127,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -107225,10 +109194,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -107236,7 +109205,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -107264,15 +109240,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -107281,7 +109258,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -107390,8 +109368,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -107443,8 +109421,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -107458,8 +109436,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -107514,7 +109492,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -107553,8 +109532,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -107765,10 +109744,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -107847,17 +109827,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -107869,7 +109849,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -107889,9 +109869,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -107899,10 +109881,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -107945,7 +109928,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -108026,11 +110009,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -108079,22 +110063,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -108107,14 +110093,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -108138,7 +110125,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -108205,10 +110192,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -108216,7 +110203,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -108244,15 +110238,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -108261,7 +110256,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -108370,8 +110366,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -108423,8 +110419,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -108438,8 +110434,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -108494,7 +110490,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -108533,8 +110530,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -108745,10 +110742,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -108827,17 +110825,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -108849,7 +110847,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -108869,9 +110867,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -108879,10 +110879,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -108925,7 +110926,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -109006,11 +111007,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -109059,22 +111061,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -109087,14 +111091,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -109118,7 +111123,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -109185,10 +111190,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -109196,7 +111201,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -109224,15 +111236,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -109241,7 +111254,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -109350,8 +111364,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -109403,8 +111417,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -109418,8 +111432,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -109474,7 +111488,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -109513,8 +111528,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -109725,10 +111740,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -109807,17 +111823,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -109829,7 +111845,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -109849,9 +111865,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -109859,10 +111877,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -109905,7 +111924,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -109986,11 +112005,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -110039,22 +112059,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -110067,14 +112089,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -110098,7 +112121,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -110165,10 +112188,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -110176,7 +112199,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -110204,15 +112234,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -110221,7 +112252,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -110330,8 +112362,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -110383,8 +112415,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -110398,8 +112430,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -110454,7 +112486,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -110493,8 +112526,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -110705,10 +112738,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -110787,17 +112821,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -110809,7 +112843,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -110829,9 +112863,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -110839,10 +112875,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -110885,7 +112922,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -110966,11 +113003,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -111019,22 +113057,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -111047,14 +113087,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -111078,7 +113119,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -111145,10 +113186,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -111156,7 +113197,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -111184,15 +113232,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -111201,7 +113250,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -111310,8 +113360,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -111363,8 +113413,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -111378,8 +113428,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -111434,7 +113484,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -111473,8 +113524,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -111685,10 +113736,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -111767,17 +113819,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -111789,7 +113841,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -111809,9 +113861,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -111819,10 +113873,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -111865,7 +113920,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -111946,11 +114001,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -111999,22 +114055,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -112027,14 +114085,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -112058,7 +114117,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -112125,10 +114184,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -112136,7 +114195,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -112164,15 +114230,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -112181,7 +114248,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -112290,8 +114358,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -112343,8 +114411,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -112358,8 +114426,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -112414,7 +114482,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -112453,8 +114522,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -112665,10 +114734,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -112747,17 +114817,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -112769,7 +114839,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -112789,9 +114859,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -112799,10 +114871,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -112845,7 +114918,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -112926,11 +114999,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -112979,22 +115053,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -113007,14 +115083,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -113038,7 +115115,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -113105,10 +115182,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -113116,7 +115193,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -113144,15 +115228,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -113161,7 +115246,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -113270,8 +115356,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -113323,8 +115409,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -113338,8 +115424,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -113394,7 +115480,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -113433,8 +115520,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -113645,10 +115732,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -113727,17 +115815,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -113749,7 +115837,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -113769,9 +115857,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -113779,10 +115869,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -113825,7 +115916,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -113906,11 +115997,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -113959,22 +116051,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -113987,14 +116081,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -114018,7 +116113,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -114085,10 +116180,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -114096,7 +116191,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -114124,15 +116226,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -114141,7 +116244,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -114250,8 +116354,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -114303,8 +116407,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -114318,8 +116422,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -114374,7 +116478,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -114413,8 +116518,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -114625,10 +116730,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -114707,17 +116813,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -114729,7 +116835,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -114749,9 +116855,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -114759,10 +116867,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -114805,7 +116914,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -114886,11 +116995,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -114939,22 +117049,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -114967,14 +117079,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -114998,7 +117111,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -115065,10 +117178,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -115076,7 +117189,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -115104,15 +117224,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -115121,7 +117242,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -115230,8 +117352,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -115283,8 +117405,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -115298,8 +117420,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -115354,7 +117476,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -115393,8 +117516,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -115605,10 +117728,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -115687,17 +117811,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -115709,7 +117833,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -115729,9 +117853,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -115739,10 +117865,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -115785,7 +117912,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -115866,11 +117993,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -115919,22 +118047,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -115947,14 +118077,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -115978,7 +118109,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -116045,10 +118176,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -116056,7 +118187,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -116084,15 +118222,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -116101,7 +118240,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -116210,8 +118350,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -116263,8 +118403,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -116278,8 +118418,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -116334,7 +118474,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -116373,8 +118514,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -116585,10 +118726,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -116667,17 +118809,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -116689,7 +118831,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -116709,9 +118851,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -116719,10 +118863,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -116765,7 +118910,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -116846,11 +118991,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -116899,22 +119045,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -116927,14 +119075,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -116958,7 +119107,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -117025,10 +119174,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -117036,7 +119185,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -117064,15 +119220,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -117081,7 +119238,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -117190,8 +119348,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -117243,8 +119401,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -117258,8 +119416,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -117314,7 +119472,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -117353,8 +119512,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -117565,10 +119724,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -117647,17 +119807,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -117669,7 +119829,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -117689,9 +119849,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -117699,10 +119861,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -117745,7 +119908,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -117826,11 +119989,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -117879,22 +120043,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -117907,14 +120073,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -117938,7 +120105,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -118005,10 +120172,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -118016,7 +120183,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -118044,15 +120218,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -118061,7 +120236,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -118170,8 +120346,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -118223,8 +120399,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -118238,8 +120414,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -118294,7 +120470,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -118333,8 +120510,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -118545,10 +120722,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -118627,17 +120805,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -118649,7 +120827,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -118669,9 +120847,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -118679,10 +120859,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -118725,7 +120906,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -118806,11 +120987,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -118859,22 +121041,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -118887,14 +121071,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -118918,7 +121103,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -118985,10 +121170,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -118996,7 +121181,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -119024,15 +121216,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -119041,7 +121234,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -119150,8 +121344,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -119203,8 +121397,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -119218,8 +121412,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -119274,7 +121468,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -119313,8 +121508,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -119525,10 +121720,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -119607,17 +121803,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -119629,7 +121825,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -119649,9 +121845,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -119659,10 +121857,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -119705,7 +121904,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -119786,11 +121985,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -119839,22 +122039,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -119867,14 +122069,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -119898,7 +122101,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -119965,10 +122168,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -119976,7 +122179,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -120004,15 +122214,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -120021,7 +122232,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -120130,8 +122342,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -120183,8 +122395,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -120198,8 +122410,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -120254,7 +122466,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -120293,8 +122506,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -120505,10 +122718,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -120587,17 +122801,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -120609,7 +122823,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -120629,9 +122843,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -120639,10 +122855,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -120685,7 +122902,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -120766,11 +122983,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -120819,22 +123037,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -120847,14 +123067,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -120878,7 +123099,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -120945,10 +123166,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -120956,7 +123177,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -120984,15 +123212,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -121001,7 +123230,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -121110,8 +123340,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -121163,8 +123393,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -121178,8 +123408,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -121234,7 +123464,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -121273,8 +123504,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -121485,10 +123716,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -121567,17 +123799,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -121589,7 +123821,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -121609,9 +123841,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -121619,10 +123853,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -121665,7 +123900,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -121746,11 +123981,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -121799,22 +124035,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -121827,14 +124065,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -121858,7 +124097,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -121925,10 +124164,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -121936,7 +124175,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -121964,15 +124210,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -121981,7 +124228,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -122090,8 +124338,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -122143,8 +124391,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -122158,8 +124406,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -122214,7 +124462,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -122253,8 +124502,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -122465,10 +124714,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -122547,17 +124797,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -122569,7 +124819,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -122589,9 +124839,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -122599,10 +124851,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -122645,7 +124898,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -122726,11 +124979,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -122779,22 +125033,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -122807,14 +125063,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -122838,7 +125095,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -122905,10 +125162,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -122916,7 +125173,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -122944,15 +125208,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -122961,7 +125226,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -123070,8 +125336,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -123123,8 +125389,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -123138,8 +125404,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -123194,7 +125460,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -123233,8 +125500,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -123445,10 +125712,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -123527,17 +125795,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -123549,7 +125817,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -123569,9 +125837,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -123579,10 +125849,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -123625,7 +125896,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -123706,11 +125977,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -123759,22 +126031,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -123787,14 +126061,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -123818,7 +126093,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -123885,10 +126160,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -123896,7 +126171,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -123924,15 +126206,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -123941,7 +126224,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -124050,8 +126334,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -124103,8 +126387,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -124118,8 +126402,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -124174,7 +126458,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -124213,8 +126498,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -124425,10 +126710,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -124507,17 +126793,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -124529,7 +126815,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -124549,9 +126835,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -124559,10 +126847,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -124605,7 +126894,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -124686,11 +126975,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -124739,22 +127029,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -124767,14 +127059,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -124798,7 +127091,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -124865,10 +127158,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -124876,7 +127169,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -124904,15 +127204,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -124921,7 +127222,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -125030,8 +127332,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -125083,8 +127385,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -125098,8 +127400,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -125154,7 +127456,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -125193,8 +127496,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -125405,10 +127708,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -125487,17 +127791,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -125509,7 +127813,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -125529,9 +127833,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -125539,10 +127845,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -125585,7 +127892,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -125666,11 +127973,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -125719,22 +128027,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -125747,14 +128057,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -125778,7 +128089,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -125845,10 +128156,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -125856,7 +128167,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -125884,15 +128202,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -125901,7 +128220,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -126010,8 +128330,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -126063,8 +128383,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -126078,8 +128398,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -126134,7 +128454,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -126173,8 +128494,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -126385,10 +128706,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -126467,17 +128789,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -126489,7 +128811,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -126509,9 +128831,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -126519,10 +128843,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -126565,7 +128890,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -126646,11 +128971,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -126699,22 +129025,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -126727,14 +129055,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -126758,7 +129087,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -126825,10 +129154,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -126836,7 +129165,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -126864,15 +129200,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -126881,7 +129218,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -126990,8 +129328,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -127043,8 +129381,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -127058,8 +129396,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -127114,7 +129452,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -127153,8 +129492,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -127365,10 +129704,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -127447,17 +129787,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -127469,7 +129809,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -127489,9 +129829,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -127499,10 +129841,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -127545,7 +129888,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -127626,11 +129969,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -127679,22 +130023,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -127707,14 +130053,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -127738,7 +130085,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -127805,10 +130152,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -127816,7 +130163,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -127844,15 +130198,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -127861,7 +130216,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -127970,8 +130326,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -128023,8 +130379,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -128038,8 +130394,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -128094,7 +130450,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -128133,8 +130490,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -128345,10 +130702,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -128427,17 +130785,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -128449,7 +130807,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -128469,9 +130827,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -128479,10 +130839,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -128525,7 +130886,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -128606,11 +130967,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -128659,22 +131021,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -128687,14 +131051,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -128718,7 +131083,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -128785,10 +131150,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -128796,7 +131161,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -128824,15 +131196,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -128841,7 +131214,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -128950,8 +131324,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -129003,8 +131377,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -129018,8 +131392,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -129074,7 +131448,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -129113,8 +131488,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -129325,10 +131700,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -129407,17 +131783,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -129429,7 +131805,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -129449,9 +131825,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -129459,10 +131837,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -129505,7 +131884,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -129586,11 +131965,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -129639,22 +132019,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -129667,14 +132049,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -129698,7 +132081,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -129765,10 +132148,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -129776,7 +132159,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -129804,15 +132194,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -129821,7 +132212,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -129930,8 +132322,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -129983,8 +132375,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -129998,8 +132390,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -130054,7 +132446,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -130093,8 +132486,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -130305,10 +132698,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -130387,17 +132781,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -130409,7 +132803,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -130429,9 +132823,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -130439,10 +132835,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -130485,7 +132882,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -130566,11 +132963,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -130619,22 +133017,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -130647,14 +133047,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -130678,7 +133079,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -130745,10 +133146,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -130756,7 +133157,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -130784,15 +133192,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -130801,7 +133210,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -130910,8 +133320,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -130963,8 +133373,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -130978,8 +133388,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -131034,7 +133444,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -131073,8 +133484,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -131285,10 +133696,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -131367,17 +133779,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -131389,7 +133801,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -131409,9 +133821,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -131419,10 +133833,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -131465,7 +133880,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -131546,11 +133961,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -131599,22 +134015,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -131627,14 +134045,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -131658,7 +134077,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -131725,10 +134144,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -131736,7 +134155,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -131764,15 +134190,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -131781,7 +134208,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -131890,8 +134318,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -131943,8 +134371,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -131958,8 +134386,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -132014,7 +134442,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -132053,8 +134482,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -132265,10 +134694,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -132347,17 +134777,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -132369,7 +134799,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -132389,9 +134819,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -132399,10 +134831,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -132445,7 +134878,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -132526,11 +134959,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -132579,22 +135013,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -132607,14 +135043,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -132638,7 +135075,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -132705,10 +135142,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -132716,7 +135153,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -132744,15 +135188,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -132761,7 +135206,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -132870,8 +135316,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -132923,8 +135369,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -132938,8 +135384,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -132994,7 +135440,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -133033,8 +135480,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -133245,10 +135692,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -133327,17 +135775,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -133349,7 +135797,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -133369,9 +135817,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -133379,10 +135829,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -133425,7 +135876,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -133506,11 +135957,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -133559,22 +136011,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -133587,14 +136041,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -133618,7 +136073,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -133685,10 +136140,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -133696,7 +136151,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -133724,15 +136186,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -133741,7 +136204,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -133850,8 +136314,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -133903,8 +136367,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -133918,8 +136382,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -133974,7 +136438,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -134013,8 +136478,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -134225,10 +136690,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -134307,17 +136773,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -134329,7 +136795,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -134349,9 +136815,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -134359,10 +136827,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -134405,7 +136874,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -134486,11 +136955,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -134539,22 +137009,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -134567,14 +137039,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -134598,7 +137071,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -134665,10 +137138,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -134676,7 +137149,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -134704,15 +137184,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -134721,7 +137202,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -134830,8 +137312,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -134883,8 +137365,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -134898,8 +137380,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -134954,7 +137436,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -134993,8 +137476,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -135205,10 +137688,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -135287,17 +137771,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -135309,7 +137793,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -135329,9 +137813,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -135339,10 +137825,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -135385,7 +137872,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -135466,11 +137953,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -135519,22 +138007,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -135547,14 +138037,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -135578,7 +138069,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -135645,10 +138136,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -135656,7 +138147,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -135684,15 +138182,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -135701,7 +138200,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -135810,8 +138310,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -135863,8 +138363,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -135878,8 +138378,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -135934,7 +138434,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -135973,8 +138474,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -136185,10 +138686,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -136267,17 +138769,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -136289,7 +138791,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -136309,9 +138811,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -136319,10 +138823,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -136365,7 +138870,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -136446,11 +138951,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -136499,22 +139005,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -136527,14 +139035,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -136558,7 +139067,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -136625,10 +139134,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -136636,7 +139145,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -136664,15 +139180,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -136681,7 +139198,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -136790,8 +139308,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -136843,8 +139361,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -136858,8 +139376,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -136914,7 +139432,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -136953,8 +139472,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -137165,10 +139684,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -137247,17 +139767,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -137269,7 +139789,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -137289,9 +139809,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -137299,10 +139821,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -137345,7 +139868,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -137426,11 +139949,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -137479,22 +140003,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -137507,14 +140033,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -137538,7 +140065,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -137605,10 +140132,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -137616,7 +140143,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -137644,15 +140178,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -137661,7 +140196,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -137770,8 +140306,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -137823,8 +140359,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -137838,8 +140374,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -137894,7 +140430,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -137933,8 +140470,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -138145,10 +140682,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -138227,17 +140765,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -138249,7 +140787,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -138269,9 +140807,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -138279,10 +140819,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -138325,7 +140866,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -138406,11 +140947,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -138459,22 +141001,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -138487,14 +141031,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -138518,7 +141063,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -138585,10 +141130,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -138596,7 +141141,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -138624,15 +141176,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -138641,7 +141194,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -138750,8 +141304,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -138803,8 +141357,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -138818,8 +141372,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -138874,7 +141428,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -138913,8 +141468,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -139125,10 +141680,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -139207,17 +141763,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -139229,7 +141785,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -139249,9 +141805,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -139259,10 +141817,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -139305,7 +141864,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -139386,11 +141945,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -139439,22 +141999,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -139467,14 +142029,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -139498,7 +142061,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -139565,10 +142128,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -139576,7 +142139,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -139604,15 +142174,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -139621,7 +142192,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -139730,8 +142302,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -139783,8 +142355,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -139798,8 +142370,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -139854,7 +142426,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -139893,8 +142466,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -140105,10 +142678,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -140187,17 +142761,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -140209,7 +142783,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -140229,9 +142803,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -140239,10 +142815,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -140285,7 +142862,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -140366,11 +142943,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -140419,22 +142997,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -140447,14 +143027,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -140478,7 +143059,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -140545,10 +143126,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -140556,7 +143137,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -140584,15 +143172,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -140601,7 +143190,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -140710,8 +143300,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -140763,8 +143353,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -140778,8 +143368,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -140834,7 +143424,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -140873,8 +143464,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -141085,10 +143676,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -141167,17 +143759,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -141189,7 +143781,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -141209,9 +143801,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -141219,10 +143813,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -141265,7 +143860,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -141346,11 +143941,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -141399,22 +143995,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -141427,14 +144025,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -141458,7 +144057,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -141525,10 +144124,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -141536,7 +144135,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -141564,15 +144170,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -141581,7 +144188,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -141690,8 +144298,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -141743,8 +144351,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -141758,8 +144366,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -141814,7 +144422,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -141853,8 +144462,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -142065,10 +144674,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -142147,17 +144757,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -142169,7 +144779,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -142189,9 +144799,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -142199,10 +144811,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -142245,7 +144858,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -142326,11 +144939,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -142379,22 +144993,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -142407,14 +145023,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -142438,7 +145055,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -142505,10 +145122,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -142516,7 +145133,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -142544,15 +145168,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -142561,7 +145186,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -142670,8 +145296,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -142723,8 +145349,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -142738,8 +145364,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -142794,7 +145420,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -142833,8 +145460,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -143045,10 +145672,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -143127,17 +145755,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -143149,7 +145777,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -143169,9 +145797,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -143179,10 +145809,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -143225,7 +145856,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -143306,11 +145937,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -143359,22 +145991,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -143387,14 +146021,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -143418,7 +146053,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -143485,10 +146120,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -143496,7 +146131,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -143524,15 +146166,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -143541,7 +146184,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -143650,8 +146294,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -143703,8 +146347,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -143718,8 +146362,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -143774,7 +146418,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -143813,8 +146458,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -144025,10 +146670,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -144107,17 +146753,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -144129,7 +146775,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -144149,9 +146795,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -144159,10 +146807,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -144205,7 +146854,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -144286,11 +146935,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -144339,22 +146989,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -144367,14 +147019,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -144398,7 +147051,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -144465,10 +147118,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -144476,7 +147129,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -144504,15 +147164,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -144521,7 +147182,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -144630,8 +147292,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -144683,8 +147345,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -144698,8 +147360,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -144754,7 +147416,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -144793,8 +147456,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -145005,10 +147668,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -145087,17 +147751,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -145109,7 +147773,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -145129,9 +147793,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -145139,10 +147805,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -145185,7 +147852,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -145266,11 +147933,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -145319,22 +147987,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -145347,14 +148017,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -145378,7 +148049,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -145445,10 +148116,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -145456,7 +148127,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -145484,15 +148162,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -145501,7 +148180,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -145610,8 +148290,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -145663,8 +148343,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -145678,8 +148358,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -145734,7 +148414,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -145773,8 +148454,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -145985,10 +148666,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -146067,17 +148749,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -146089,7 +148771,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -146109,9 +148791,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -146119,10 +148803,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -146165,7 +148850,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -146246,11 +148931,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -146299,22 +148985,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -146327,14 +149015,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -146358,7 +149047,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -146425,10 +149114,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -146436,7 +149125,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -146464,15 +149160,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -146481,7 +149178,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -146590,8 +149288,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -146643,8 +149341,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -146658,8 +149356,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -146714,7 +149412,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -146753,8 +149452,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -146965,10 +149664,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -147047,17 +149747,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -147069,7 +149769,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -147089,9 +149789,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -147099,10 +149801,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -147145,7 +149848,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -147226,11 +149929,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -147279,22 +149983,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -147307,14 +150013,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -147338,7 +150045,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -147405,10 +150112,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -147416,7 +150123,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -147444,15 +150158,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -147461,7 +150176,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -147570,8 +150286,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -147623,8 +150339,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -147638,8 +150354,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -147694,7 +150410,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -147733,8 +150450,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -147945,10 +150662,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -148027,17 +150745,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -148049,7 +150767,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -148069,9 +150787,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -148079,10 +150799,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -148125,7 +150846,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -148206,11 +150927,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -148259,22 +150981,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -148287,14 +151011,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -148318,7 +151043,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -148385,10 +151110,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -148396,7 +151121,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -148424,15 +151156,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -148441,7 +151174,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -148550,8 +151284,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -148603,8 +151337,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -148618,8 +151352,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -148674,7 +151408,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -148713,8 +151448,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -148925,10 +151660,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -149007,17 +151743,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -149029,7 +151765,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -149049,9 +151785,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -149059,10 +151797,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -149105,7 +151844,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -149186,11 +151925,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -149239,22 +151979,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -149267,14 +152009,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -149298,7 +152041,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -149365,10 +152108,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -149376,7 +152119,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -149404,15 +152154,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -149421,7 +152172,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -149530,8 +152282,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -149583,8 +152335,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -149598,8 +152350,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -149654,7 +152406,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -149693,8 +152446,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -149905,10 +152658,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -149987,17 +152741,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -150009,7 +152763,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -150029,9 +152783,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -150039,10 +152795,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -150085,7 +152842,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -150166,11 +152923,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -150219,22 +152977,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -150247,14 +153007,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -150278,7 +153039,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -150345,10 +153106,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -150356,7 +153117,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -150384,15 +153152,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -150401,7 +153170,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -150510,8 +153280,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -150563,8 +153333,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -150578,8 +153348,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -150634,7 +153404,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -150673,8 +153444,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -150885,10 +153656,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -150967,17 +153739,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -150989,7 +153761,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -151009,9 +153781,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -151019,10 +153793,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -151065,7 +153840,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -151146,11 +153921,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -151199,22 +153975,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -151227,14 +154005,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -151258,7 +154037,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -151325,10 +154104,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -151336,7 +154115,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -151364,15 +154150,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -151381,7 +154168,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -151490,8 +154278,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -151543,8 +154331,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -151558,8 +154346,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -151614,7 +154402,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -151653,8 +154442,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -151865,10 +154654,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -151947,17 +154737,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -151969,7 +154759,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -151989,9 +154779,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -151999,10 +154791,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -152045,7 +154838,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -152126,11 +154919,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -152179,22 +154973,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -152207,14 +155003,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -152238,7 +155035,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -152305,10 +155102,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -152316,7 +155113,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -152344,15 +155148,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -152361,7 +155166,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -152470,8 +155276,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -152523,8 +155329,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -152538,8 +155344,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -152594,7 +155400,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -152633,8 +155440,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -152845,10 +155652,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -152927,17 +155735,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -152949,7 +155757,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -152969,9 +155777,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -152979,10 +155789,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -153025,7 +155836,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -153106,11 +155917,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -153159,22 +155971,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -153187,14 +156001,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -153218,7 +156033,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -153285,10 +156100,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -153296,7 +156111,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -153324,15 +156146,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -153341,7 +156164,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -153450,8 +156274,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -153503,8 +156327,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -153518,8 +156342,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -153574,7 +156398,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -153613,8 +156438,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -153825,10 +156650,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -153907,17 +156733,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -153929,7 +156755,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -153949,9 +156775,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -153959,10 +156787,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -154005,7 +156834,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -154086,11 +156915,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -154139,22 +156969,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -154167,14 +156999,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -154198,7 +157031,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -154265,10 +157098,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -154276,7 +157109,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -154304,15 +157144,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -154321,7 +157162,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -154430,8 +157272,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -154483,8 +157325,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -154498,8 +157340,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -154554,7 +157396,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -154593,8 +157436,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -154805,10 +157648,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -154887,17 +157731,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -154909,7 +157753,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -154929,9 +157773,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -154939,10 +157785,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -154985,7 +157832,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -155066,11 +157913,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -155119,22 +157967,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -155147,14 +157997,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -155178,7 +158029,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -155245,10 +158096,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -155256,7 +158107,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -155284,15 +158142,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -155301,7 +158160,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -155410,8 +158270,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -155463,8 +158323,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -155478,8 +158338,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -155534,7 +158394,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -155573,8 +158434,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -155785,10 +158646,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -155867,17 +158729,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -155889,7 +158751,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -155909,9 +158771,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -155919,10 +158783,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -155965,7 +158830,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -156046,11 +158911,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -156099,22 +158965,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -156127,14 +158995,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -156158,7 +159027,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -156225,10 +159094,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -156236,7 +159105,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -156264,15 +159140,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -156281,7 +159158,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -156390,8 +159268,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -156443,8 +159321,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -156458,8 +159336,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -156514,7 +159392,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -156553,8 +159432,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -156765,10 +159644,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -156847,17 +159727,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -156869,7 +159749,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -156889,9 +159769,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -156899,10 +159781,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -156945,7 +159828,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -157026,11 +159909,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -157079,22 +159963,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -157107,14 +159993,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -157138,7 +160025,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -157205,10 +160092,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -157216,7 +160103,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -157244,15 +160138,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -157261,7 +160156,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -157370,8 +160266,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -157423,8 +160319,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -157438,8 +160334,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -157494,7 +160390,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -157533,8 +160430,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -157745,10 +160642,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -157827,17 +160725,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -157849,7 +160747,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -157869,9 +160767,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -157879,10 +160779,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -157925,7 +160826,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -158006,11 +160907,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -158059,22 +160961,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -158087,14 +160991,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -158118,7 +161023,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -158185,10 +161090,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -158196,7 +161101,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -158224,15 +161136,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -158241,7 +161154,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -158350,8 +161264,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -158403,8 +161317,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -158418,8 +161332,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -158474,7 +161388,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -158513,8 +161428,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -158725,10 +161640,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -158807,17 +161723,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -158829,7 +161745,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -158849,9 +161765,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -158859,10 +161777,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -158905,7 +161824,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -158986,11 +161905,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -159039,22 +161959,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -159067,14 +161989,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -159098,7 +162021,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -159165,10 +162088,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -159176,7 +162099,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -159204,15 +162134,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -159221,7 +162152,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -159330,8 +162262,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -159383,8 +162315,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -159398,8 +162330,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -159454,7 +162386,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -159493,8 +162426,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -159705,10 +162638,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -159787,17 +162721,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -159809,7 +162743,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -159829,9 +162763,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -159839,10 +162775,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -159885,7 +162822,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -159966,11 +162903,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -160019,22 +162957,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -160047,14 +162987,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -160078,7 +163019,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -160145,10 +163086,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -160156,7 +163097,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -160184,15 +163132,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -160201,7 +163150,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -160310,8 +163260,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -160363,8 +163313,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -160378,8 +163328,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -160434,7 +163384,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -160473,8 +163424,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -160685,10 +163636,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -160767,17 +163719,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -160789,7 +163741,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -160809,9 +163761,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -160819,10 +163773,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -160865,7 +163820,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -160946,11 +163901,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -160999,22 +163955,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -161027,14 +163985,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -161058,7 +164017,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -161125,10 +164084,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -161136,7 +164095,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -161164,15 +164130,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -161181,7 +164148,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -161290,8 +164258,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -161343,8 +164311,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -161358,8 +164326,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -161414,7 +164382,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -161453,8 +164422,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -161665,10 +164634,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -161747,17 +164717,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -161769,7 +164739,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -161789,9 +164759,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -161799,10 +164771,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -161845,7 +164818,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -161926,11 +164899,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -161979,22 +164953,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -162007,14 +164983,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -162038,7 +165015,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -162105,10 +165082,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -162116,7 +165093,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -162144,15 +165128,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -162161,7 +165146,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -162270,8 +165256,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -162323,8 +165309,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -162338,8 +165324,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -162394,7 +165380,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -162433,8 +165420,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -162645,10 +165632,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -162727,17 +165715,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -162749,7 +165737,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -162769,9 +165757,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -162779,10 +165769,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -162825,7 +165816,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -162906,11 +165897,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -162959,22 +165951,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -162987,14 +165981,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -163018,7 +166013,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -163085,10 +166080,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -163096,7 +166091,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -163124,15 +166126,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -163141,7 +166144,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -163250,8 +166254,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -163303,8 +166307,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -163318,8 +166322,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -163374,7 +166378,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -163413,8 +166418,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -163625,10 +166630,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -163707,17 +166713,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -163729,7 +166735,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -163749,9 +166755,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -163759,10 +166767,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -163805,7 +166814,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -163886,11 +166895,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -163939,22 +166949,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -163967,14 +166979,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -163998,7 +167011,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -164065,10 +167078,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -164076,7 +167089,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -164104,15 +167124,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -164121,7 +167142,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -164230,8 +167252,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -164283,8 +167305,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -164298,8 +167320,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -164354,7 +167376,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -164393,8 +167416,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -164605,10 +167628,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -164687,17 +167711,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -164709,7 +167733,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -164729,9 +167753,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -164739,10 +167765,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -164785,7 +167812,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -164866,11 +167893,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -164919,22 +167947,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -164947,14 +167977,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -164978,7 +168009,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -165045,10 +168076,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -165056,7 +168087,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -165084,15 +168122,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -165101,7 +168140,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -165210,8 +168250,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -165263,8 +168303,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -165278,8 +168318,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -165334,7 +168374,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -165373,8 +168414,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -165585,10 +168626,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -165667,17 +168709,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -165689,7 +168731,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -165709,9 +168751,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -165719,10 +168763,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -165765,7 +168810,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -165846,11 +168891,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -165899,22 +168945,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -165927,14 +168975,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -165958,7 +169007,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -166025,10 +169074,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -166036,7 +169085,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -166064,15 +169120,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -166081,7 +169138,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -166190,8 +169248,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -166243,8 +169301,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -166258,8 +169316,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -166314,7 +169372,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -166353,8 +169412,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -166565,10 +169624,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -166647,17 +169707,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -166669,7 +169729,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -166689,9 +169749,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -166699,10 +169761,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -166745,7 +169808,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -166826,11 +169889,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -166879,22 +169943,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -166907,14 +169973,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -166938,7 +170005,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -167005,10 +170072,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -167016,7 +170083,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -167044,15 +170118,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -167061,7 +170136,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -167170,8 +170246,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -167223,8 +170299,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -167238,8 +170314,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -167294,7 +170370,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -167333,8 +170410,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -167545,10 +170622,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -167627,17 +170705,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -167649,7 +170727,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -167669,9 +170747,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -167679,10 +170759,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -167725,7 +170806,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -167806,11 +170887,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -167859,22 +170941,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -167887,14 +170971,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -167918,7 +171003,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -167985,10 +171070,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -167996,7 +171081,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -168024,15 +171116,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -168041,7 +171134,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -168150,8 +171244,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -168203,8 +171297,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -168218,8 +171312,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -168274,7 +171368,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -168313,8 +171408,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -168525,10 +171620,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -168607,17 +171703,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -168629,7 +171725,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -168649,9 +171745,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -168659,10 +171757,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -168705,7 +171804,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -168786,11 +171885,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -168839,22 +171939,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -168867,14 +171969,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -168898,7 +172001,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -168965,10 +172068,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -168976,7 +172079,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -169004,15 +172114,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -169021,7 +172132,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -169130,8 +172242,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -169183,8 +172295,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -169198,8 +172310,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -169254,7 +172366,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -169293,8 +172406,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -169505,10 +172618,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -169587,17 +172701,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -169609,7 +172723,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -169629,9 +172743,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -169639,10 +172755,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -169685,7 +172802,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -169766,11 +172883,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -169819,22 +172937,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -169847,14 +172967,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -169878,7 +172999,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -169945,10 +173066,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -169956,7 +173077,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -169984,15 +173112,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -170001,7 +173130,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -170110,8 +173240,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -170163,8 +173293,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -170178,8 +173308,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -170234,7 +173364,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -170273,8 +173404,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -170485,10 +173616,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -170567,17 +173699,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -170589,7 +173721,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -170609,9 +173741,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -170619,10 +173753,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -170665,7 +173800,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -170746,11 +173881,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -170799,22 +173935,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -170827,14 +173965,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -170858,7 +173997,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -170925,10 +174064,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -170936,7 +174075,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -170964,15 +174110,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -170981,7 +174128,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -171090,8 +174238,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -171143,8 +174291,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -171158,8 +174306,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -171214,7 +174362,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -171253,8 +174402,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -171465,10 +174614,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -171547,17 +174697,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -171569,7 +174719,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -171589,9 +174739,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -171599,10 +174751,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -171645,7 +174798,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -171726,11 +174879,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -171779,22 +174933,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -171807,14 +174963,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -171838,7 +174995,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -171905,10 +175062,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -171916,7 +175073,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -171944,15 +175108,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -171961,7 +175126,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -172070,8 +175236,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -172123,8 +175289,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -172138,8 +175304,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -172194,7 +175360,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -172233,8 +175400,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -172445,10 +175612,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -172527,17 +175695,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -172549,7 +175717,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -172569,9 +175737,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -172579,10 +175749,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -172625,7 +175796,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -172706,11 +175877,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -172759,22 +175931,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -172787,14 +175961,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -172818,7 +175993,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -172885,10 +176060,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -172896,7 +176071,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -172924,15 +176106,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -172941,7 +176124,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -173050,8 +176234,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -173103,8 +176287,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -173118,8 +176302,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -173174,7 +176358,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -173213,8 +176398,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -173425,10 +176610,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -173507,17 +176693,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -173529,7 +176715,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -173549,9 +176735,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -173559,10 +176747,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -173605,7 +176794,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -173686,11 +176875,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -173739,22 +176929,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -173767,14 +176959,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -173798,7 +176991,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -173865,10 +177058,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -173876,7 +177069,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -173904,15 +177104,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -173921,7 +177122,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -174030,8 +177232,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -174083,8 +177285,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -174098,8 +177300,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -174154,7 +177356,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -174193,8 +177396,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -174405,10 +177608,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -174487,17 +177691,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -174509,7 +177713,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -174529,9 +177733,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -174539,10 +177745,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -174585,7 +177792,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -174666,11 +177873,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -174719,22 +177927,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -174747,14 +177957,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -174778,7 +177989,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -174845,10 +178056,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -174856,7 +178067,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -174884,15 +178102,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -174901,7 +178120,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -175010,8 +178230,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -175063,8 +178283,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -175078,8 +178298,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -175134,7 +178354,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -175173,8 +178394,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -175385,10 +178606,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -175467,17 +178689,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -175489,7 +178711,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -175509,9 +178731,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -175519,10 +178743,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -175565,7 +178790,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -175646,11 +178871,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -175699,22 +178925,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -175727,14 +178955,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -175758,7 +178987,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -175825,10 +179054,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -175836,7 +179065,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -175864,15 +179100,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -175881,7 +179118,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -175990,8 +179228,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -176043,8 +179281,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -176058,8 +179296,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -176114,7 +179352,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -176153,8 +179392,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -176365,10 +179604,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -176447,17 +179687,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -176469,7 +179709,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -176489,9 +179729,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -176499,10 +179741,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -176545,7 +179788,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -176626,11 +179869,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -176679,22 +179923,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -176707,14 +179953,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -176738,7 +179985,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -176805,10 +180052,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -176816,7 +180063,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -176844,15 +180098,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -176861,7 +180116,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -176970,8 +180226,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -177023,8 +180279,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -177038,8 +180294,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -177094,7 +180350,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -177133,8 +180390,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -177345,10 +180602,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -177427,17 +180685,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -177449,7 +180707,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -177469,9 +180727,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -177479,10 +180739,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -177525,7 +180786,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -177606,11 +180867,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -177659,22 +180921,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -177687,14 +180951,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -177718,7 +180983,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -177785,10 +181050,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -177796,7 +181061,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -177824,15 +181096,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -177841,7 +181114,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -177950,8 +181224,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -178003,8 +181277,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -178018,8 +181292,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -178074,7 +181348,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -178113,8 +181388,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -178325,10 +181600,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -178407,17 +181683,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -178429,7 +181705,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -178449,9 +181725,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -178459,10 +181737,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -178505,7 +181784,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -178586,11 +181865,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -178639,22 +181919,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -178667,14 +181949,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -178698,7 +181981,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -178765,10 +182048,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -178776,7 +182059,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -178804,15 +182094,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -178821,7 +182112,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -178930,8 +182222,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -178983,8 +182275,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -178998,8 +182290,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -179054,7 +182346,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -179093,8 +182386,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -179305,10 +182598,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -179387,17 +182681,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -179409,7 +182703,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -179429,9 +182723,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -179439,10 +182735,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -179485,7 +182782,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -179566,11 +182863,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -179619,22 +182917,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -179647,14 +182947,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -179678,7 +182979,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -179745,10 +183046,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -179756,7 +183057,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -179784,15 +183092,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -179801,7 +183110,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -179910,8 +183220,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -179963,8 +183273,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -179978,8 +183288,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -180034,7 +183344,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -180073,8 +183384,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -180285,10 +183596,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -180367,17 +183679,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -180389,7 +183701,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -180409,9 +183721,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -180419,10 +183733,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -180465,7 +183780,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -180546,11 +183861,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -180599,22 +183915,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -180627,14 +183945,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -180658,7 +183977,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -180725,10 +184044,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -180736,7 +184055,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -180764,15 +184090,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -180781,7 +184108,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -180890,8 +184218,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -180943,8 +184271,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -180958,8 +184286,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -181014,7 +184342,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -181053,8 +184382,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -181265,10 +184594,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -181347,17 +184677,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -181369,7 +184699,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -181389,9 +184719,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -181399,10 +184731,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -181445,7 +184778,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -181526,11 +184859,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -181579,22 +184913,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -181607,14 +184943,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -181638,7 +184975,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -181705,10 +185042,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -181716,7 +185053,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -181744,15 +185088,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -181761,7 +185106,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -181870,8 +185216,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -181923,8 +185269,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -181938,8 +185284,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -181994,7 +185340,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -182033,8 +185380,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -182245,10 +185592,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -182327,17 +185675,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -182349,7 +185697,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -182369,9 +185717,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -182379,10 +185729,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -182425,7 +185776,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -182506,11 +185857,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -182559,22 +185911,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -182587,14 +185941,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -182618,7 +185973,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -182685,10 +186040,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -182696,7 +186051,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -182724,15 +186086,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -182741,7 +186104,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -182850,8 +186214,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -182903,8 +186267,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -182918,8 +186282,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -182974,7 +186338,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -183013,8 +186378,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -183225,10 +186590,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -183307,17 +186673,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -183329,7 +186695,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -183349,9 +186715,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -183359,10 +186727,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -183405,7 +186774,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -183486,11 +186855,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -183539,22 +186909,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -183567,14 +186939,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -183598,7 +186971,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -183665,10 +187038,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -183676,7 +187049,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -183704,15 +187084,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -183721,7 +187102,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -183830,8 +187212,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -183883,8 +187265,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -183898,8 +187280,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -183954,7 +187336,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -183993,8 +187376,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -184205,10 +187588,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -184287,17 +187671,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -184309,7 +187693,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -184329,9 +187713,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -184339,10 +187725,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -184385,7 +187772,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -184466,11 +187853,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -184519,22 +187907,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -184547,14 +187937,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -184578,7 +187969,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -184645,10 +188036,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -184656,7 +188047,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -184684,15 +188082,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -184701,7 +188100,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -184810,8 +188210,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -184863,8 +188263,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -184878,8 +188278,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -184934,7 +188334,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -184973,8 +188374,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -185185,10 +188586,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -185267,17 +188669,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -185289,7 +188691,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -185309,9 +188711,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -185319,10 +188723,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -185365,7 +188770,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -185446,11 +188851,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -185499,22 +188905,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -185527,14 +188935,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -185558,7 +188967,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -185625,10 +189034,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -185636,7 +189045,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -185664,15 +189080,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -185681,7 +189098,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -185790,8 +189208,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -185843,8 +189261,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -185858,8 +189276,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -185914,7 +189332,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -185953,8 +189372,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -186165,10 +189584,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -186247,17 +189667,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -186269,7 +189689,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -186289,9 +189709,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -186299,10 +189721,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -186345,7 +189768,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -186426,11 +189849,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -186479,22 +189903,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -186507,14 +189933,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -186538,7 +189965,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -186605,10 +190032,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -186616,7 +190043,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -186644,15 +190078,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -186661,7 +190096,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -186770,8 +190206,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -186823,8 +190259,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -186838,8 +190274,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -186894,7 +190330,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -186933,8 +190370,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -187145,10 +190582,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -187227,17 +190665,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -187249,7 +190687,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -187269,9 +190707,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -187279,10 +190719,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -187325,7 +190766,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -187406,11 +190847,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -187459,22 +190901,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -187487,14 +190931,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -187518,7 +190963,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -187585,10 +191030,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -187596,7 +191041,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -187624,15 +191076,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -187641,7 +191094,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -187750,8 +191204,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -187803,8 +191257,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -187818,8 +191272,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -187874,7 +191328,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -187913,8 +191368,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -188125,10 +191580,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -188207,17 +191663,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -188229,7 +191685,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -188249,9 +191705,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -188259,10 +191717,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -188305,7 +191764,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -188386,11 +191845,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -188439,22 +191899,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -188467,14 +191929,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -188498,7 +191961,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -188565,10 +192028,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -188576,7 +192039,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -188604,15 +192074,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -188621,7 +192092,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -188730,8 +192202,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -188783,8 +192255,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -188798,8 +192270,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -188854,7 +192326,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -188893,8 +192366,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -189105,10 +192578,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -189187,17 +192661,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -189209,7 +192683,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -189229,9 +192703,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -189239,10 +192715,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -189285,7 +192762,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -189366,11 +192843,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -189419,22 +192897,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -189447,14 +192927,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -189478,7 +192959,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -189545,10 +193026,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -189556,7 +193037,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -189584,15 +193072,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -189601,7 +193090,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -189710,8 +193200,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -189763,8 +193253,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -189778,8 +193268,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -189834,7 +193324,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -189873,8 +193364,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -190085,10 +193576,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -190167,17 +193659,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -190189,7 +193681,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -190209,9 +193701,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -190219,10 +193713,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -190265,7 +193760,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -190346,11 +193841,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -190399,22 +193895,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -190427,14 +193925,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -190458,7 +193957,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -190525,10 +194024,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -190536,7 +194035,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -190564,15 +194070,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -190581,7 +194088,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -190690,8 +194198,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -190743,8 +194251,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -190758,8 +194266,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -190814,7 +194322,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -190853,8 +194362,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -191065,10 +194574,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -191147,17 +194657,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -191169,7 +194679,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -191189,9 +194699,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -191199,10 +194711,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -191245,7 +194758,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -191326,11 +194839,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -191379,22 +194893,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -191407,14 +194923,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -191438,7 +194955,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -191505,10 +195022,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -191516,7 +195033,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -191544,15 +195068,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -191561,7 +195086,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -191670,8 +195196,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -191723,8 +195249,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -191738,8 +195264,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -191794,7 +195320,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -191833,8 +195360,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -192045,10 +195572,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -192127,17 +195655,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -192149,7 +195677,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -192169,9 +195697,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -192179,10 +195709,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -192225,7 +195756,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -192306,11 +195837,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -192359,22 +195891,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -192387,14 +195921,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -192418,7 +195953,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -192485,10 +196020,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -192496,7 +196031,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -192524,15 +196066,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -192541,7 +196084,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -192650,8 +196194,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -192703,8 +196247,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -192718,8 +196262,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -192774,7 +196318,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -192813,8 +196358,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -193025,10 +196570,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -193107,17 +196653,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -193129,7 +196675,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -193149,9 +196695,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -193159,10 +196707,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -193205,7 +196754,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -193286,11 +196835,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -193339,22 +196889,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -193367,14 +196919,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -193398,7 +196951,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -193465,10 +197018,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -193476,7 +197029,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -193504,15 +197064,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -193521,7 +197082,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -193630,8 +197192,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -193683,8 +197245,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -193698,8 +197260,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -193754,7 +197316,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -193793,8 +197356,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -194005,10 +197568,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -194087,17 +197651,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -194109,7 +197673,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -194129,9 +197693,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -194139,10 +197705,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -194185,7 +197752,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -194266,11 +197833,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -194319,22 +197887,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -194347,14 +197917,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -194378,7 +197949,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -194445,10 +198016,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -194456,7 +198027,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -194484,15 +198062,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -194501,7 +198080,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -194610,8 +198190,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -194663,8 +198243,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -194678,8 +198258,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -194734,7 +198314,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -194773,8 +198354,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -194985,10 +198566,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -195067,17 +198649,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -195089,7 +198671,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -195109,9 +198691,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -195119,10 +198703,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -195165,7 +198750,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -195246,11 +198831,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -195299,22 +198885,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -195327,14 +198915,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -195358,7 +198947,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -195425,10 +199014,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -195436,7 +199025,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -195464,15 +199060,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -195481,7 +199078,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -195590,8 +199188,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -195643,8 +199241,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -195658,8 +199256,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -195714,7 +199312,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -195753,8 +199352,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -195965,10 +199564,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -196047,17 +199647,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -196069,7 +199669,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -196089,9 +199689,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -196099,10 +199701,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -196145,7 +199748,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -196226,11 +199829,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -196279,22 +199883,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -196307,14 +199913,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -196338,7 +199945,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -196405,10 +200012,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -196416,7 +200023,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -196444,15 +200058,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -196461,7 +200076,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -196570,8 +200186,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -196623,8 +200239,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -196638,8 +200254,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -196694,7 +200310,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -196733,8 +200350,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -196945,10 +200562,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -197027,17 +200645,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -197049,7 +200667,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -197069,9 +200687,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -197079,10 +200699,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -197125,7 +200746,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -197206,11 +200827,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -197259,22 +200881,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -197287,14 +200911,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -197318,7 +200943,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -197385,10 +201010,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -197396,7 +201021,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -197424,15 +201056,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -197441,7 +201074,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -197550,8 +201184,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -197603,8 +201237,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -197618,8 +201252,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -197674,7 +201308,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -197713,8 +201348,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -197925,10 +201560,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -198007,17 +201643,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -198029,7 +201665,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -198049,9 +201685,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -198059,10 +201697,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -198105,7 +201744,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -198186,11 +201825,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -198239,22 +201879,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -198267,14 +201909,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -198298,7 +201941,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -198365,10 +202008,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -198376,7 +202019,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -198404,15 +202054,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -198421,7 +202072,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -198530,8 +202182,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -198583,8 +202235,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -198598,8 +202250,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -198654,7 +202306,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -198693,8 +202346,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -198905,10 +202558,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -198987,17 +202641,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -199009,7 +202663,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -199029,9 +202683,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -199039,10 +202695,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -199085,7 +202742,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -199166,11 +202823,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -199219,22 +202877,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -199247,14 +202907,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -199278,7 +202939,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -199345,10 +203006,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -199356,7 +203017,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -199384,15 +203052,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -199401,7 +203070,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -199510,8 +203180,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -199563,8 +203233,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -199578,8 +203248,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -199634,7 +203304,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -199673,8 +203344,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -199885,10 +203556,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -199967,17 +203639,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -199989,7 +203661,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -200009,9 +203681,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -200019,10 +203693,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -200065,7 +203740,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -200146,11 +203821,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -200199,22 +203875,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -200227,14 +203905,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -200258,7 +203937,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -200325,10 +204004,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -200336,7 +204015,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -200364,15 +204050,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -200381,7 +204068,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -200490,8 +204178,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -200543,8 +204231,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -200558,8 +204246,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -200614,7 +204302,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -200653,8 +204342,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -200865,10 +204554,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -200947,17 +204637,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -200969,7 +204659,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -200989,9 +204679,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -200999,10 +204691,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -201045,7 +204738,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -201126,11 +204819,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -201179,22 +204873,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -201207,14 +204903,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -201238,7 +204935,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -201305,10 +205002,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -201316,7 +205013,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -201344,15 +205048,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -201361,7 +205066,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -201470,8 +205176,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -201523,8 +205229,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -201538,8 +205244,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -201594,7 +205300,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -201633,8 +205340,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -201845,10 +205552,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -201927,17 +205635,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -201949,7 +205657,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -201969,9 +205677,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -201979,10 +205689,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -202025,7 +205736,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -202106,11 +205817,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -202159,22 +205871,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -202187,14 +205901,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -202218,7 +205933,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -202285,10 +206000,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -202296,7 +206011,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -202324,15 +206046,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -202341,7 +206064,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -202450,8 +206174,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -202503,8 +206227,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -202518,8 +206242,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -202574,7 +206298,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -202613,8 +206338,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -202825,10 +206550,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -202907,17 +206633,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -202929,7 +206655,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -202949,9 +206675,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -202959,10 +206687,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -203005,7 +206734,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -203086,11 +206815,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -203139,22 +206869,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -203167,14 +206899,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -203198,7 +206931,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -203265,10 +206998,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -203276,7 +207009,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -203304,15 +207044,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -203321,7 +207062,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -203430,8 +207172,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -203483,8 +207225,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -203498,8 +207240,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -203554,7 +207296,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -203593,8 +207336,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -203805,10 +207548,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -203887,17 +207631,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -203909,7 +207653,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -203929,9 +207673,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -203939,10 +207685,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -203985,7 +207732,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -204066,11 +207813,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -204119,22 +207867,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -204147,14 +207897,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -204178,7 +207929,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -204245,10 +207996,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -204256,7 +208007,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -204284,15 +208042,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -204301,7 +208060,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -204410,8 +208170,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -204463,8 +208223,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -204478,8 +208238,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -204534,7 +208294,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -204573,8 +208334,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -204785,10 +208546,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -204867,17 +208629,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -204889,7 +208651,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -204909,9 +208671,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -204919,10 +208683,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -204965,7 +208730,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -205046,11 +208811,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -205099,22 +208865,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -205127,14 +208895,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -205158,7 +208927,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -205225,10 +208994,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -205236,7 +209005,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -205264,15 +209040,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -205281,7 +209058,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -205390,8 +209168,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -205443,8 +209221,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -205458,8 +209236,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -205514,7 +209292,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -205553,8 +209332,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -205765,10 +209544,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -205847,17 +209627,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -205869,7 +209649,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -205889,9 +209669,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -205899,10 +209681,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -205945,7 +209728,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -206026,11 +209809,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -206079,22 +209863,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -206107,14 +209893,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -206138,7 +209925,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -206205,10 +209992,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -206216,7 +210003,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -206244,15 +210038,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -206261,7 +210056,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -206370,8 +210166,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -206423,8 +210219,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -206438,8 +210234,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -206494,7 +210290,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -206533,8 +210330,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -206745,10 +210542,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -206827,17 +210625,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -206849,7 +210647,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -206869,9 +210667,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -206879,10 +210679,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -206925,7 +210726,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -207006,11 +210807,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -207059,22 +210861,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -207087,14 +210891,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -207118,7 +210923,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -207185,10 +210990,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -207196,7 +211001,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -207224,15 +211036,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -207241,7 +211054,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -207350,8 +211164,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -207403,8 +211217,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -207418,8 +211232,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -207474,7 +211288,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -207513,8 +211328,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -207725,10 +211540,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -207807,17 +211623,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -207829,7 +211645,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -207849,9 +211665,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -207859,10 +211677,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -207905,7 +211724,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -207986,11 +211805,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -208039,22 +211859,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -208067,14 +211889,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -208098,7 +211921,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -208165,10 +211988,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -208176,7 +211999,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -208204,15 +212034,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -208221,7 +212052,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -208330,8 +212162,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -208383,8 +212215,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -208398,8 +212230,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -208454,7 +212286,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -208493,8 +212326,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -208705,10 +212538,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -208787,17 +212621,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -208809,7 +212643,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -208829,9 +212663,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -208839,10 +212675,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -208885,7 +212722,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -208966,11 +212803,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -209019,22 +212857,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -209047,14 +212887,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -209078,7 +212919,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -209145,10 +212986,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -209156,7 +212997,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -209184,15 +213032,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -209201,7 +213050,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -209310,8 +213160,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -209363,8 +213213,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -209378,8 +213228,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -209434,7 +213284,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -209473,8 +213324,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -209685,10 +213536,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -209767,17 +213619,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -209789,7 +213641,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -209809,9 +213661,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -209819,10 +213673,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -209865,7 +213720,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -209946,11 +213801,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -209999,22 +213855,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -210027,14 +213885,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -210058,7 +213917,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -210125,10 +213984,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -210136,7 +213995,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -210164,15 +214030,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -210181,7 +214048,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -210290,8 +214158,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -210343,8 +214211,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -210358,8 +214226,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -210414,7 +214282,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -210453,8 +214322,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -210665,10 +214534,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -210747,17 +214617,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -210769,7 +214639,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -210789,9 +214659,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -210799,10 +214671,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -210845,7 +214718,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -210926,11 +214799,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -210979,22 +214853,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -211007,14 +214883,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -211038,7 +214915,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -211105,10 +214982,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -211116,7 +214993,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -211144,15 +215028,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -211161,7 +215046,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -211270,8 +215156,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -211323,8 +215209,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -211338,8 +215224,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -211394,7 +215280,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -211433,8 +215320,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -211645,10 +215532,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -211727,17 +215615,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -211749,7 +215637,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -211769,9 +215657,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -211779,10 +215669,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -211825,7 +215716,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -211906,11 +215797,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -211959,22 +215851,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -211987,14 +215881,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -212018,7 +215913,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -212085,10 +215980,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -212096,7 +215991,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -212124,15 +216026,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -212141,7 +216044,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -212250,8 +216154,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -212303,8 +216207,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -212318,8 +216222,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -212374,7 +216278,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -212413,8 +216318,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -212625,10 +216530,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -212707,17 +216613,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -212729,7 +216635,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -212749,9 +216655,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -212759,10 +216667,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -212805,7 +216714,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -212886,11 +216795,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -212939,22 +216849,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -212967,14 +216879,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -212998,7 +216911,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -213065,10 +216978,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -213076,7 +216989,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -213104,15 +217024,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -213121,7 +217042,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -213230,8 +217152,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -213283,8 +217205,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -213298,8 +217220,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -213354,7 +217276,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -213393,8 +217316,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -213605,10 +217528,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -213687,17 +217611,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -213709,7 +217633,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -213729,9 +217653,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -213739,10 +217665,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -213785,7 +217712,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -213866,11 +217793,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -213919,22 +217847,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -213947,14 +217877,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -213978,7 +217909,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -214045,10 +217976,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -214056,7 +217987,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -214084,15 +218022,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -214101,7 +218040,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -214210,8 +218150,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -214263,8 +218203,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -214278,8 +218218,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -214334,7 +218274,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -214373,8 +218314,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -214585,10 +218526,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -214667,17 +218609,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -214689,7 +218631,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -214709,9 +218651,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -214719,10 +218663,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -214765,7 +218710,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -214846,11 +218791,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -214899,22 +218845,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -214927,14 +218875,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -214958,7 +218907,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -215025,10 +218974,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -215036,7 +218985,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -215064,15 +219020,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -215081,7 +219038,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -215190,8 +219148,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -215243,8 +219201,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -215258,8 +219216,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -215314,7 +219272,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -215353,8 +219312,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -215565,10 +219524,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -215647,17 +219607,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -215669,7 +219629,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -215689,9 +219649,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -215699,10 +219661,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -215745,7 +219708,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -215826,11 +219789,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -215879,22 +219843,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -215907,14 +219873,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -215938,7 +219905,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -216005,10 +219972,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -216016,7 +219983,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -216044,15 +220018,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -216061,7 +220036,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -216170,8 +220146,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -216223,8 +220199,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -216238,8 +220214,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -216294,7 +220270,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -216333,8 +220310,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -216545,10 +220522,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -216627,17 +220605,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -216649,7 +220627,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -216669,9 +220647,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -216679,10 +220659,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -216725,7 +220706,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -216806,11 +220787,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -216859,22 +220841,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -216887,14 +220871,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -216918,7 +220903,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -216985,10 +220970,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -216996,7 +220981,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -217024,15 +221016,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -217041,7 +221034,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -217150,8 +221144,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -217203,8 +221197,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -217218,8 +221212,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -217274,7 +221268,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -217313,8 +221308,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -217525,10 +221520,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -217607,17 +221603,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -217629,7 +221625,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -217649,9 +221645,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -217659,10 +221657,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -217705,7 +221704,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -217786,11 +221785,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -217839,22 +221839,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -217867,14 +221869,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -217898,7 +221901,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -217965,10 +221968,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -217976,7 +221979,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -218004,15 +222014,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -218021,7 +222032,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -218130,8 +222142,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -218183,8 +222195,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -218198,8 +222210,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -218254,7 +222266,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -218293,8 +222306,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -218505,10 +222518,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -218587,17 +222601,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -218609,7 +222623,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -218629,9 +222643,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -218639,10 +222655,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -218685,7 +222702,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -218766,11 +222783,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -218819,22 +222837,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -218847,14 +222867,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -218878,7 +222899,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -218945,10 +222966,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -218956,7 +222977,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -218984,15 +223012,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -219001,7 +223030,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -219110,8 +223140,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -219163,8 +223193,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -219178,8 +223208,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -219234,7 +223264,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -219273,8 +223304,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -219485,10 +223516,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -219567,17 +223599,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -219589,7 +223621,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -219609,9 +223641,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -219619,10 +223653,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -219665,7 +223700,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -219746,11 +223781,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -219799,22 +223835,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -219827,14 +223865,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -219858,7 +223897,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -219925,10 +223964,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -219936,7 +223975,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -219964,15 +224010,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -219981,7 +224028,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -220090,8 +224138,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -220143,8 +224191,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -220158,8 +224206,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -220214,7 +224262,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -220253,8 +224302,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -220465,10 +224514,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -220547,17 +224597,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -220569,7 +224619,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -220589,9 +224639,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -220599,10 +224651,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -220645,7 +224698,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -220726,11 +224779,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -220779,22 +224833,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -220807,14 +224863,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -220838,7 +224895,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -220905,10 +224962,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -220916,7 +224973,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -220944,15 +225008,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -220961,7 +225026,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -221070,8 +225136,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -221123,8 +225189,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -221138,8 +225204,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -221194,7 +225260,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -221233,8 +225300,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -221445,10 +225512,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -221527,17 +225595,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -221549,7 +225617,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -221569,9 +225637,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -221579,10 +225649,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -221625,7 +225696,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -221706,11 +225777,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -221759,22 +225831,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -221787,14 +225861,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -221818,7 +225893,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -221885,10 +225960,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -221896,7 +225971,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -221924,15 +226006,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -221941,7 +226024,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -222050,8 +226134,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -222103,8 +226187,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -222118,8 +226202,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -222174,7 +226258,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -222213,8 +226298,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -222425,10 +226510,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -222507,17 +226593,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -222529,7 +226615,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -222549,9 +226635,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -222559,10 +226647,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -222605,7 +226694,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -222686,11 +226775,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -222739,22 +226829,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -222767,14 +226859,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -222798,7 +226891,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -222865,10 +226958,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -222876,7 +226969,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -222904,15 +227004,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -222921,7 +227022,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -223030,8 +227132,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -223083,8 +227185,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -223098,8 +227200,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -223154,7 +227256,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -223193,8 +227296,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -223405,10 +227508,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -223487,17 +227591,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -223509,7 +227613,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -223529,9 +227633,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -223539,10 +227645,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -223585,7 +227692,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -223666,11 +227773,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -223719,22 +227827,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -223747,14 +227857,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -223778,7 +227889,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -223845,10 +227956,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -223856,7 +227967,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -223884,15 +228002,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -223901,7 +228020,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -224010,8 +228130,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -224063,8 +228183,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -224078,8 +228198,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -224134,7 +228254,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -224173,8 +228294,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -224385,10 +228506,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -224467,17 +228589,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -224489,7 +228611,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -224509,9 +228631,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -224519,10 +228643,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -224565,7 +228690,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -224646,11 +228771,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -224699,22 +228825,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -224727,14 +228855,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -224758,7 +228887,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -224825,10 +228954,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -224836,7 +228965,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -224864,15 +229000,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -224881,7 +229018,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -224990,8 +229128,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -225043,8 +229181,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -225058,8 +229196,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -225114,7 +229252,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -225153,8 +229292,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -225365,10 +229504,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -225447,17 +229587,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -225469,7 +229609,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -225489,9 +229629,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -225499,10 +229641,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -225545,7 +229688,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -225626,11 +229769,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -225679,22 +229823,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -225707,14 +229853,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -225738,7 +229885,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -225805,10 +229952,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -225816,7 +229963,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -225844,15 +229998,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -225861,7 +230016,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -225970,8 +230126,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -226023,8 +230179,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -226038,8 +230194,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -226094,7 +230250,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -226133,8 +230290,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -226345,10 +230502,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -226427,17 +230585,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -226449,7 +230607,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -226469,9 +230627,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -226479,10 +230639,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -226525,7 +230686,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -226606,11 +230767,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -226659,22 +230821,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -226687,14 +230851,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -226718,7 +230883,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -226785,10 +230950,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -226796,7 +230961,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -226824,15 +230996,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -226841,7 +231014,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -226950,8 +231124,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -227003,8 +231177,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -227018,8 +231192,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -227074,7 +231248,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -227113,8 +231288,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -227325,10 +231500,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -227407,17 +231583,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -227429,7 +231605,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -227449,9 +231625,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -227459,10 +231637,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -227505,7 +231684,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -227586,11 +231765,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -227639,22 +231819,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -227667,14 +231849,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -227698,7 +231881,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -227765,10 +231948,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -227776,7 +231959,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -227804,15 +231994,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -227821,7 +232012,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -227930,8 +232122,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -227983,8 +232175,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -227998,8 +232190,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -228054,7 +232246,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -228093,8 +232286,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -228305,10 +232498,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -228387,17 +232581,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -228409,7 +232603,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -228429,9 +232623,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -228439,10 +232635,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -228485,7 +232682,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -228566,11 +232763,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -228619,22 +232817,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -228647,14 +232847,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -228678,7 +232879,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -228745,10 +232946,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -228756,7 +232957,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -228784,15 +232992,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -228801,7 +233010,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -228910,8 +233120,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -228963,8 +233173,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -228978,8 +233188,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -229034,7 +233244,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -229073,8 +233284,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -229285,10 +233496,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -229367,17 +233579,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -229389,7 +233601,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -229409,9 +233621,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -229419,10 +233633,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -229465,7 +233680,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -229546,11 +233761,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -229599,22 +233815,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -229627,14 +233845,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -229658,7 +233877,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -229725,10 +233944,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -229736,7 +233955,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -229764,15 +233990,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -229781,7 +234008,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -229890,8 +234118,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -229943,8 +234171,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -229958,8 +234186,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -230014,7 +234242,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -230053,8 +234282,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -230265,10 +234494,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -230347,17 +234577,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -230369,7 +234599,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -230389,9 +234619,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -230399,10 +234631,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -230445,7 +234678,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -230526,11 +234759,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -230579,22 +234813,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -230607,14 +234843,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -230638,7 +234875,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -230705,10 +234942,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -230716,7 +234953,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -230744,15 +234988,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -230761,7 +235006,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -230870,8 +235116,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -230923,8 +235169,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -230938,8 +235184,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -230994,7 +235240,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -231033,8 +235280,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -231245,10 +235492,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -231327,17 +235575,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -231349,7 +235597,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -231369,9 +235617,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -231379,10 +235629,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -231425,7 +235676,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -231506,11 +235757,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -231559,22 +235811,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -231587,14 +235841,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -231618,7 +235873,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -231685,10 +235940,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -231696,7 +235951,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -231724,15 +235986,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -231741,7 +236004,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -231850,8 +236114,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -231903,8 +236167,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -231918,8 +236182,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -231974,7 +236238,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -232013,8 +236278,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -232225,10 +236490,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -232307,17 +236573,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -232329,7 +236595,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -232349,9 +236615,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -232359,10 +236627,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -232405,7 +236674,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -232486,11 +236755,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -232539,22 +236809,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -232567,14 +236839,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -232598,7 +236871,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -232665,10 +236938,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -232676,7 +236949,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -232704,15 +236984,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -232721,7 +237002,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -232830,8 +237112,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -232883,8 +237165,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -232898,8 +237180,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -232954,7 +237236,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -232993,8 +237276,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -233205,10 +237488,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -233287,17 +237571,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -233309,7 +237593,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -233329,9 +237613,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -233339,10 +237625,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -233385,7 +237672,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -233466,11 +237753,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -233519,22 +237807,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -233547,14 +237837,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -233578,7 +237869,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -233645,10 +237936,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -233656,7 +237947,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -233684,15 +237982,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -233701,7 +238000,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -233810,8 +238110,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -233863,8 +238163,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -233878,8 +238178,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -233934,7 +238234,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -233973,8 +238274,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -234185,10 +238486,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -234267,17 +238569,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -234289,7 +238591,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -234309,9 +238611,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -234319,10 +238623,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -234365,7 +238670,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -234446,11 +238751,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -234499,22 +238805,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -234527,14 +238835,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -234558,7 +238867,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -234625,10 +238934,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -234636,7 +238945,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -234664,15 +238980,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -234681,7 +238998,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -234790,8 +239108,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -234843,8 +239161,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -234858,8 +239176,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -234914,7 +239232,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -234953,8 +239272,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -235165,10 +239484,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -235247,17 +239567,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -235269,7 +239589,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -235289,9 +239609,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -235299,10 +239621,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -235345,7 +239668,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -235426,11 +239749,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -235479,22 +239803,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -235507,14 +239833,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -235538,7 +239865,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -235605,10 +239932,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -235616,7 +239943,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -235644,15 +239978,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -235661,7 +239996,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -235770,8 +240106,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -235823,8 +240159,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -235838,8 +240174,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -235894,7 +240230,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -235933,8 +240270,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -236145,10 +240482,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -236227,17 +240565,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -236249,7 +240587,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -236269,9 +240607,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -236279,10 +240619,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -236325,7 +240666,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -236406,11 +240747,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -236459,22 +240801,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -236487,14 +240831,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -236518,7 +240863,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -236585,10 +240930,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -236596,7 +240941,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -236624,15 +240976,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -236641,7 +240994,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -236750,8 +241104,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -236803,8 +241157,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -236818,8 +241172,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -236874,7 +241228,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -236913,8 +241268,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -237125,10 +241480,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -237207,17 +241563,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -237229,7 +241585,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -237249,9 +241605,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -237259,10 +241617,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -237305,7 +241664,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -237386,11 +241745,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -237439,22 +241799,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -237467,14 +241829,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -237498,7 +241861,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -237565,10 +241928,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -237576,7 +241939,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -237604,15 +241974,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -237621,7 +241992,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -237730,8 +242102,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -237783,8 +242155,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -237798,8 +242170,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -237854,7 +242226,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -237893,8 +242266,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -238105,10 +242478,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -238187,17 +242561,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -238209,7 +242583,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -238229,9 +242603,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -238239,10 +242615,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -238285,7 +242662,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -238366,11 +242743,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -238419,22 +242797,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -238447,14 +242827,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -238478,7 +242859,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -238545,10 +242926,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -238556,7 +242937,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -238584,15 +242972,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -238601,7 +242990,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -238710,8 +243100,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -238763,8 +243153,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -238778,8 +243168,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -238834,7 +243224,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -238873,8 +243264,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -239085,10 +243476,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -239167,17 +243559,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -239189,7 +243581,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -239209,9 +243601,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -239219,10 +243613,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -239265,7 +243660,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -239346,11 +243741,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -239399,22 +243795,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -239427,14 +243825,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -239458,7 +243857,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -239525,10 +243924,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -239536,7 +243935,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -239564,15 +243970,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -239581,7 +243988,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -239690,8 +244098,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -239743,8 +244151,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -239758,8 +244166,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -239814,7 +244222,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -239853,8 +244262,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -240065,10 +244474,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -240147,17 +244557,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -240169,7 +244579,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -240189,9 +244599,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -240199,10 +244611,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -240245,7 +244658,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -240326,11 +244739,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -240379,22 +244793,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -240407,14 +244823,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -240438,7 +244855,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -240505,10 +244922,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -240516,7 +244933,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -240544,15 +244968,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -240561,7 +244986,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -240670,8 +245096,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -240723,8 +245149,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -240738,8 +245164,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -240794,7 +245220,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -240833,8 +245260,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -241045,10 +245472,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -241127,17 +245555,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -241149,7 +245577,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -241169,9 +245597,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -241179,10 +245609,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -241225,7 +245656,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -241306,11 +245737,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -241359,22 +245791,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -241387,14 +245821,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -241418,7 +245853,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -241485,10 +245920,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -241496,7 +245931,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -241524,15 +245966,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -241541,7 +245984,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -241650,8 +246094,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -241703,8 +246147,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -241718,8 +246162,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -241774,7 +246218,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -241813,8 +246258,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -242025,10 +246470,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -242107,17 +246553,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -242129,7 +246575,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -242149,9 +246595,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -242159,10 +246607,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -242205,7 +246654,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -242286,11 +246735,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -242339,22 +246789,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -242367,14 +246819,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -242398,7 +246851,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -242465,10 +246918,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -242476,7 +246929,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -242504,15 +246964,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -242521,7 +246982,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -242630,8 +247092,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -242683,8 +247145,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -242698,8 +247160,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -242754,7 +247216,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -242793,8 +247256,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -243005,10 +247468,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -243087,17 +247551,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -243109,7 +247573,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -243129,9 +247593,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -243139,10 +247605,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -243185,7 +247652,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -243266,11 +247733,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -243319,22 +247787,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -243347,14 +247817,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -243378,7 +247849,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -243445,10 +247916,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -243456,7 +247927,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -243484,15 +247962,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -243501,7 +247980,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -243610,8 +248090,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -243663,8 +248143,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -243678,8 +248158,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -243734,7 +248214,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -243773,8 +248254,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -243985,10 +248466,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -244067,17 +248549,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -244089,7 +248571,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -244109,9 +248591,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -244119,10 +248603,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -244165,7 +248650,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -244246,11 +248731,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -244299,22 +248785,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -244327,14 +248815,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -244358,7 +248847,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -244425,10 +248914,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -244436,7 +248925,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -244464,15 +248960,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -244481,7 +248978,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -244590,8 +249088,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -244643,8 +249141,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -244658,8 +249156,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -244714,7 +249212,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -244753,8 +249252,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -244965,10 +249464,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -245047,17 +249547,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -245069,7 +249569,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -245089,9 +249589,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -245099,10 +249601,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -245145,7 +249648,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -245226,11 +249729,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -245279,22 +249783,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -245307,14 +249813,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -245338,7 +249845,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -245405,10 +249912,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -245416,7 +249923,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -245444,15 +249958,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -245461,7 +249976,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -245570,8 +250086,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -245623,8 +250139,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -245638,8 +250154,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -245694,7 +250210,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -245733,8 +250250,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -245945,10 +250462,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -246027,17 +250545,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -246049,7 +250567,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -246069,9 +250587,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -246079,10 +250599,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -246125,7 +250646,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -246206,11 +250727,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -246259,22 +250781,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -246287,14 +250811,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -246318,7 +250843,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -246385,10 +250910,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -246396,7 +250921,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -246424,15 +250956,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -246441,7 +250974,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -246550,8 +251084,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -246603,8 +251137,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -246618,8 +251152,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -246674,7 +251208,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -246713,8 +251248,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -246925,10 +251460,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -247007,17 +251543,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -247029,7 +251565,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -247049,9 +251585,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -247059,10 +251597,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -247105,7 +251644,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -247186,11 +251725,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -247239,22 +251779,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -247267,14 +251809,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -247298,7 +251841,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -247365,10 +251908,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -247376,7 +251919,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -247404,15 +251954,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -247421,7 +251972,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -247530,8 +252082,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -247583,8 +252135,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -247598,8 +252150,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -247654,7 +252206,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -247693,8 +252246,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -247905,10 +252458,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -247987,17 +252541,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -248009,7 +252563,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -248029,9 +252583,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -248039,10 +252595,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -248085,7 +252642,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -248166,11 +252723,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -248219,22 +252777,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -248247,14 +252807,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -248278,7 +252839,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -248345,10 +252906,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -248356,7 +252917,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -248384,15 +252952,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -248401,7 +252970,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -248510,8 +253080,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -248563,8 +253133,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -248578,8 +253148,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -248634,7 +253204,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -248673,8 +253244,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -248885,10 +253456,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -248967,17 +253539,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -248989,7 +253561,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -249009,9 +253581,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -249019,10 +253593,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -249065,7 +253640,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -249146,11 +253721,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -249199,22 +253775,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -249227,14 +253805,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -249258,7 +253837,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -249325,10 +253904,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -249336,7 +253915,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -249364,15 +253950,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -249381,7 +253968,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -249490,8 +254078,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -249543,8 +254131,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -249558,8 +254146,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -249614,7 +254202,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -249653,8 +254242,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -249865,10 +254454,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -249947,17 +254537,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -249969,7 +254559,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -249989,9 +254579,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -249999,10 +254591,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -250045,7 +254638,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -250126,11 +254719,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -250179,22 +254773,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -250207,14 +254803,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -250238,7 +254835,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -250305,10 +254902,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -250316,7 +254913,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -250344,15 +254948,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -250361,7 +254966,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -250470,8 +255076,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -250523,8 +255129,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -250538,8 +255144,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -250594,7 +255200,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -250633,8 +255240,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -250845,10 +255452,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -250927,17 +255535,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -250949,7 +255557,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -250969,9 +255577,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -250979,10 +255589,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -251025,7 +255636,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -251106,11 +255717,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -251159,22 +255771,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -251187,14 +255801,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -251218,7 +255833,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -251285,10 +255900,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -251296,7 +255911,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -251324,15 +255946,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -251341,7 +255964,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -251450,8 +256074,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -251503,8 +256127,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -251518,8 +256142,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -251574,7 +256198,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -251613,8 +256238,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -251825,10 +256450,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -251907,17 +256533,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -251929,7 +256555,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -251949,9 +256575,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -251959,10 +256587,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -252005,7 +256634,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -252086,11 +256715,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -252139,22 +256769,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -252167,14 +256799,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -252198,7 +256831,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -252265,10 +256898,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -252276,7 +256909,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -252304,15 +256944,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -252321,7 +256962,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -252430,8 +257072,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -252483,8 +257125,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -252498,8 +257140,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -252554,7 +257196,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -252593,8 +257236,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -252805,10 +257448,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -252887,17 +257531,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -252909,7 +257553,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -252929,9 +257573,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -252939,10 +257585,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -252985,7 +257632,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -253066,11 +257713,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -253119,22 +257767,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -253147,14 +257797,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -253178,7 +257829,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -253245,10 +257896,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -253256,7 +257907,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -253284,15 +257942,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -253301,7 +257960,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -253410,8 +258070,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -253463,8 +258123,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -253478,8 +258138,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -253534,7 +258194,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -253573,8 +258234,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -253785,10 +258446,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -253867,17 +258529,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -253889,7 +258551,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -253909,9 +258571,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -253919,10 +258583,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -253965,7 +258630,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -254046,11 +258711,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -254099,22 +258765,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -254127,14 +258795,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -254158,7 +258827,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -254225,10 +258894,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -254236,7 +258905,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -254264,15 +258940,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -254281,7 +258958,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -254390,8 +259068,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -254443,8 +259121,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -254458,8 +259136,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -254514,7 +259192,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -254553,8 +259232,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -254765,10 +259444,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -254847,17 +259527,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -254869,7 +259549,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -254889,9 +259569,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -254899,10 +259581,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -254945,7 +259628,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -255026,11 +259709,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -255079,22 +259763,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -255107,14 +259793,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -255138,7 +259825,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -255205,10 +259892,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -255216,7 +259903,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -255244,15 +259938,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -255261,7 +259956,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -255370,8 +260066,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -255423,8 +260119,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -255438,8 +260134,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -255494,7 +260190,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -255533,8 +260230,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -255745,10 +260442,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -255827,17 +260525,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -255849,7 +260547,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -255869,9 +260567,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -255879,10 +260579,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -255925,7 +260626,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -256006,11 +260707,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -256059,22 +260761,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -256087,14 +260791,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -256118,7 +260823,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -256185,10 +260890,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -256196,7 +260901,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -256224,15 +260936,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -256241,7 +260954,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -256350,8 +261064,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -256403,8 +261117,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -256418,8 +261132,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -256474,7 +261188,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -256513,8 +261228,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -256725,10 +261440,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -256807,17 +261523,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -256829,7 +261545,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -256849,9 +261565,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -256859,10 +261577,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -256905,7 +261624,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -256986,11 +261705,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -257039,22 +261759,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -257067,14 +261789,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -257098,7 +261821,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -257165,10 +261888,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -257176,7 +261899,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -257204,15 +261934,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -257221,7 +261952,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -257330,8 +262062,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -257383,8 +262115,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -257398,8 +262130,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -257454,7 +262186,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -257493,8 +262226,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -257705,10 +262438,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -257787,17 +262521,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -257809,7 +262543,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -257829,9 +262563,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -257839,10 +262575,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -257885,7 +262622,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -257966,11 +262703,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -258019,22 +262757,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -258047,14 +262787,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -258078,7 +262819,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -258145,10 +262886,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -258156,7 +262897,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -258184,15 +262932,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -258201,7 +262950,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -258310,8 +263060,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -258363,8 +263113,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -258378,8 +263128,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -258434,7 +263184,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -258473,8 +263224,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -258685,10 +263436,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -258767,17 +263519,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -258789,7 +263541,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -258809,9 +263561,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -258819,10 +263573,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -258865,7 +263620,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -258946,11 +263701,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -258999,22 +263755,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -259027,14 +263785,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -259058,7 +263817,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -259125,10 +263884,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -259136,7 +263895,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -259164,15 +263930,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -259181,7 +263948,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -259290,8 +264058,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -259343,8 +264111,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -259358,8 +264126,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -259414,7 +264182,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -259453,8 +264222,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -259665,10 +264434,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -259747,17 +264517,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -259769,7 +264539,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -259789,9 +264559,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -259799,10 +264571,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -259845,7 +264618,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -259926,11 +264699,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -259979,22 +264753,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -260007,14 +264783,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -260038,7 +264815,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -260105,10 +264882,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -260116,7 +264893,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -260144,15 +264928,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -260161,7 +264946,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -260270,8 +265056,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -260323,8 +265109,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -260338,8 +265124,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -260394,7 +265180,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -260433,8 +265220,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -260645,10 +265432,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -260727,17 +265515,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -260749,7 +265537,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -260769,9 +265557,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -260779,10 +265569,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -260825,7 +265616,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -260906,11 +265697,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -260959,22 +265751,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -260987,14 +265781,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -261018,7 +265813,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -261085,10 +265880,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -261096,7 +265891,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -261124,15 +265926,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -261141,7 +265944,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -261250,8 +266054,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -261303,8 +266107,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -261318,8 +266122,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -261374,7 +266178,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -261413,8 +266218,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -261625,10 +266430,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -261707,17 +266513,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -261729,7 +266535,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -261749,9 +266555,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -261759,10 +266567,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -261805,7 +266614,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -261886,11 +266695,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -261939,22 +266749,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -261967,14 +266779,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -261998,7 +266811,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -262065,10 +266878,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -262076,7 +266889,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -262104,15 +266924,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -262121,7 +266942,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -262230,8 +267052,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -262283,8 +267105,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -262298,8 +267120,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -262354,7 +267176,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -262393,8 +267216,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -262605,10 +267428,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -262687,17 +267511,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -262709,7 +267533,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -262729,9 +267553,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -262739,10 +267565,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -262785,7 +267612,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -262866,11 +267693,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -262919,22 +267747,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -262947,14 +267777,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -262978,7 +267809,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -263045,10 +267876,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -263056,7 +267887,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -263084,15 +267922,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -263101,7 +267940,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -263210,8 +268050,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -263263,8 +268103,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -263278,8 +268118,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -263334,7 +268174,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -263373,8 +268214,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -263585,10 +268426,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -263667,17 +268509,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -263689,7 +268531,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -263709,9 +268551,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -263719,10 +268563,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -263765,7 +268610,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -263846,11 +268691,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -263899,22 +268745,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -263927,14 +268775,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -263958,7 +268807,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -264025,10 +268874,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -264036,7 +268885,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -264064,15 +268920,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -264081,7 +268938,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -264190,8 +269048,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -264243,8 +269101,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -264258,8 +269116,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -264314,7 +269172,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -264353,8 +269212,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -264565,10 +269424,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -264647,17 +269507,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -264669,7 +269529,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -264689,9 +269549,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -264699,10 +269561,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -264745,7 +269608,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -264826,11 +269689,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -264879,22 +269743,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -264907,14 +269773,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -264938,7 +269805,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -265005,10 +269872,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -265016,7 +269883,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -265044,15 +269918,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -265061,7 +269936,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -265170,8 +270046,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -265223,8 +270099,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -265238,8 +270114,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -265294,7 +270170,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -265333,8 +270210,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -265545,10 +270422,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -265627,17 +270505,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -265649,7 +270527,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -265669,9 +270547,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -265679,10 +270559,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -265725,7 +270606,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -265806,11 +270687,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -265859,22 +270741,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -265887,14 +270771,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -265918,7 +270803,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -265985,10 +270870,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -265996,7 +270881,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -266024,15 +270916,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -266041,7 +270934,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -266150,8 +271044,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -266203,8 +271097,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -266218,8 +271112,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -266274,7 +271168,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -266313,8 +271208,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -266525,10 +271420,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -266607,17 +271503,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -266629,7 +271525,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -266649,9 +271545,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -266659,10 +271557,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -266705,7 +271604,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -266786,11 +271685,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -266839,22 +271739,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -266867,14 +271769,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -266898,7 +271801,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -266965,10 +271868,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -266976,7 +271879,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -267004,15 +271914,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -267021,7 +271932,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -267130,8 +272042,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -267183,8 +272095,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -267198,8 +272110,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -267254,7 +272166,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -267293,8 +272206,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -267505,10 +272418,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -267587,17 +272501,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -267609,7 +272523,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -267629,9 +272543,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -267639,10 +272555,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -267685,7 +272602,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -267766,11 +272683,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -267819,22 +272737,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -267847,14 +272767,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -267878,7 +272799,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -267945,10 +272866,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -267956,7 +272877,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -267984,15 +272912,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -268001,7 +272930,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -268110,8 +273040,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -268163,8 +273093,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -268178,8 +273108,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -268234,7 +273164,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -268273,8 +273204,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -268485,10 +273416,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -268567,17 +273499,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -268589,7 +273521,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -268609,9 +273541,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -268619,10 +273553,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -268665,7 +273600,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -268746,11 +273681,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -268799,22 +273735,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -268827,14 +273765,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -268858,7 +273797,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -268925,10 +273864,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -268936,7 +273875,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -268964,15 +273910,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -268981,7 +273928,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -269090,8 +274038,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -269143,8 +274091,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -269158,8 +274106,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -269214,7 +274162,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -269253,8 +274202,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -269465,10 +274414,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -269547,17 +274497,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -269569,7 +274519,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -269589,9 +274539,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -269599,10 +274551,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -269645,7 +274598,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -269726,11 +274679,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -269779,22 +274733,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -269807,14 +274763,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -269838,7 +274795,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -269905,10 +274862,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -269916,7 +274873,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -269944,15 +274908,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -269961,7 +274926,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -270070,8 +275036,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -270123,8 +275089,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -270138,8 +275104,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -270194,7 +275160,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -270233,8 +275200,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -270445,10 +275412,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -270527,17 +275495,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -270549,7 +275517,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -270569,9 +275537,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -270579,10 +275549,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -270625,7 +275596,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -270706,11 +275677,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -270759,22 +275731,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -270787,14 +275761,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -270818,7 +275793,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -270885,10 +275860,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -270896,7 +275871,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -270924,15 +275906,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -270941,7 +275924,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -271050,8 +276034,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -271103,8 +276087,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -271118,8 +276102,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -271174,7 +276158,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -271213,8 +276198,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -271425,10 +276410,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -271507,17 +276493,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -271529,7 +276515,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -271549,9 +276535,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -271559,10 +276547,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -271605,7 +276594,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -271686,11 +276675,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -271739,22 +276729,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -271767,14 +276759,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -271798,7 +276791,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -271865,10 +276858,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -271876,7 +276869,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -271904,15 +276904,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -271921,7 +276922,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -272030,8 +277032,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -272083,8 +277085,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -272098,8 +277100,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -272154,7 +277156,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -272193,8 +277196,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -272405,10 +277408,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -272487,17 +277491,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -272509,7 +277513,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -272529,9 +277533,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -272539,10 +277545,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -272585,7 +277592,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -272666,11 +277673,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -272719,22 +277727,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -272747,14 +277757,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -272778,7 +277789,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -272845,10 +277856,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -272856,7 +277867,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -272884,15 +277902,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -272901,7 +277920,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -273010,8 +278030,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -273063,8 +278083,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -273078,8 +278098,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -273134,7 +278154,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -273173,8 +278194,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -273385,10 +278406,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -273467,17 +278489,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -273489,7 +278511,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -273509,9 +278531,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -273519,10 +278543,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -273565,7 +278590,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -273646,11 +278671,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -273699,22 +278725,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -273727,14 +278755,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -273758,7 +278787,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -273825,10 +278854,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -273836,7 +278865,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -273864,15 +278900,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -273881,7 +278918,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -273990,8 +279028,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -274043,8 +279081,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -274058,8 +279096,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -274114,7 +279152,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -274153,8 +279192,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -274365,10 +279404,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -274447,17 +279487,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -274469,7 +279509,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -274489,9 +279529,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -274499,10 +279541,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -274545,7 +279588,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -274626,11 +279669,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -274679,22 +279723,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -274707,14 +279753,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -274738,7 +279785,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -274805,10 +279852,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -274816,7 +279863,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -274844,15 +279898,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -274861,7 +279916,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -274970,8 +280026,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -275023,8 +280079,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -275038,8 +280094,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -275094,7 +280150,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -275133,8 +280190,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -275345,10 +280402,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -275427,17 +280485,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -275449,7 +280507,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -275469,9 +280527,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -275479,10 +280539,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -275525,7 +280586,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -275606,11 +280667,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -275659,22 +280721,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -275687,14 +280751,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -275718,7 +280783,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -275785,10 +280850,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -275796,7 +280861,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -275824,15 +280896,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -275841,7 +280914,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -275950,8 +281024,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -276003,8 +281077,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -276018,8 +281092,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -276074,7 +281148,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -276113,8 +281188,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -276325,10 +281400,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -276407,17 +281483,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -276429,7 +281505,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -276449,9 +281525,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -276459,10 +281537,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -276505,7 +281584,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -276586,11 +281665,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -276639,22 +281719,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -276667,14 +281749,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -276698,7 +281781,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -276765,10 +281848,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -276776,7 +281859,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -276804,15 +281894,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -276821,7 +281912,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -276930,8 +282022,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -276983,8 +282075,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -276998,8 +282090,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -277054,7 +282146,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -277093,8 +282186,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -277305,10 +282398,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -277387,17 +282481,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -277409,7 +282503,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -277429,9 +282523,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -277439,10 +282535,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -277485,7 +282582,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -277566,11 +282663,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -277619,22 +282717,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -277647,14 +282747,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -277678,7 +282779,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -277745,10 +282846,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -277756,7 +282857,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -277784,15 +282892,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -277801,7 +282910,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -277910,8 +283020,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -277963,8 +283073,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -277978,8 +283088,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -278034,7 +283144,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -278073,8 +283184,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -278285,10 +283396,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -278367,17 +283479,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -278389,7 +283501,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -278409,9 +283521,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -278419,10 +283533,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -278465,7 +283580,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -278546,11 +283661,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -278599,22 +283715,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -278627,14 +283745,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -278658,7 +283777,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -278725,10 +283844,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -278736,7 +283855,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -278764,15 +283890,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -278781,7 +283908,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -278890,8 +284018,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -278943,8 +284071,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -278958,8 +284086,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -279014,7 +284142,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -279053,8 +284182,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -279265,10 +284394,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -279347,17 +284477,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -279369,7 +284499,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -279389,9 +284519,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -279399,10 +284531,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -279445,7 +284578,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -279526,11 +284659,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -279579,22 +284713,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -279607,14 +284743,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -279638,7 +284775,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -279705,10 +284842,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -279716,7 +284853,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -279744,15 +284888,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -279761,7 +284906,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -279870,8 +285016,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -279923,8 +285069,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -279938,8 +285084,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -279994,7 +285140,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -280033,8 +285180,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -280245,10 +285392,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -280327,17 +285475,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -280349,7 +285497,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -280369,9 +285517,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -280379,10 +285529,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -280425,7 +285576,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -280506,11 +285657,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -280559,22 +285711,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -280587,14 +285741,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -280618,7 +285773,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -280685,10 +285840,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -280696,7 +285851,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -280724,15 +285886,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -280741,7 +285904,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -280850,8 +286014,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -280903,8 +286067,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -280918,8 +286082,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -280974,7 +286138,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -281013,8 +286178,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -281225,10 +286390,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -281307,17 +286473,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -281329,7 +286495,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -281349,9 +286515,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -281359,10 +286527,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -281405,7 +286574,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -281486,11 +286655,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -281539,22 +286709,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -281567,14 +286739,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -281598,7 +286771,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -281665,10 +286838,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -281676,7 +286849,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -281704,15 +286884,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -281721,7 +286902,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -281830,8 +287012,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -281883,8 +287065,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -281898,8 +287080,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -281954,7 +287136,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -281993,8 +287176,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -282205,10 +287388,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -282287,17 +287471,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -282309,7 +287493,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -282329,9 +287513,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -282339,10 +287525,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -282385,7 +287572,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -282466,11 +287653,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -282519,22 +287707,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -282547,14 +287737,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -282578,7 +287769,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -282645,10 +287836,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -282656,7 +287847,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -282684,15 +287882,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -282701,7 +287900,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -282810,8 +288010,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -282863,8 +288063,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -282878,8 +288078,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -282934,7 +288134,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -282973,8 +288174,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -283185,10 +288386,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -283267,17 +288469,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -283289,7 +288491,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -283309,9 +288511,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -283319,10 +288523,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -283365,7 +288570,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -283446,11 +288651,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -283499,22 +288705,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -283527,14 +288735,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -283558,7 +288767,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -283625,10 +288834,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -283636,7 +288845,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -283664,15 +288880,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -283681,7 +288898,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -283790,8 +289008,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -283843,8 +289061,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -283858,8 +289076,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -283914,7 +289132,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -283953,8 +289172,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -284165,10 +289384,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -284247,17 +289467,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -284269,7 +289489,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -284289,9 +289509,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -284299,10 +289521,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -284345,7 +289568,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -284426,11 +289649,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -284479,22 +289703,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -284507,14 +289733,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -284538,7 +289765,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -284605,10 +289832,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -284616,7 +289843,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -284644,15 +289878,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -284661,7 +289896,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -284770,8 +290006,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -284823,8 +290059,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -284838,8 +290074,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -284894,7 +290130,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -284933,8 +290170,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -285145,10 +290382,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -285227,17 +290465,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -285249,7 +290487,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -285269,9 +290507,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -285279,10 +290519,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -285325,7 +290566,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -285406,11 +290647,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -285459,22 +290701,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -285487,14 +290731,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -285518,7 +290763,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -285585,10 +290830,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -285596,7 +290841,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -285624,15 +290876,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -285641,7 +290894,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -285750,8 +291004,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -285803,8 +291057,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -285818,8 +291072,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -285874,7 +291128,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -285913,8 +291168,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -286125,10 +291380,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -286207,17 +291463,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -286229,7 +291485,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -286249,9 +291505,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -286259,10 +291517,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -286305,7 +291564,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -286386,11 +291645,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -286439,22 +291699,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -286467,14 +291729,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -286498,7 +291761,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -286565,10 +291828,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -286576,7 +291839,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -286604,15 +291874,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -286621,7 +291892,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -286730,8 +292002,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -286783,8 +292055,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -286798,8 +292070,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -286854,7 +292126,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -286893,8 +292166,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -287105,10 +292378,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -287187,17 +292461,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -287209,7 +292483,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -287229,9 +292503,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -287239,10 +292515,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -287285,7 +292562,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -287366,11 +292643,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -287419,22 +292697,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -287447,14 +292727,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -287478,7 +292759,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -287545,10 +292826,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -287556,7 +292837,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -287584,15 +292872,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -287601,7 +292890,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -287710,8 +293000,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -287763,8 +293053,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -287778,8 +293068,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -287834,7 +293124,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -287873,8 +293164,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -288085,10 +293376,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -288167,17 +293459,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -288189,7 +293481,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -288209,9 +293501,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -288219,10 +293513,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -288265,7 +293560,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -288346,11 +293641,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -288399,22 +293695,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -288427,14 +293725,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -288458,7 +293757,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -288525,10 +293824,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -288536,7 +293835,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -288564,15 +293870,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -288581,7 +293888,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -288690,8 +293998,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -288743,8 +294051,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -288758,8 +294066,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -288814,7 +294122,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -288853,8 +294162,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -289065,10 +294374,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -289147,17 +294457,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -289169,7 +294479,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -289189,9 +294499,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -289199,10 +294511,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -289245,7 +294558,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -289326,11 +294639,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -289379,22 +294693,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -289407,14 +294723,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -289438,7 +294755,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -289505,10 +294822,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -289516,7 +294833,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -289544,15 +294868,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -289561,7 +294886,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -289670,8 +294996,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -289723,8 +295049,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -289738,8 +295064,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -289794,7 +295120,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -289833,8 +295160,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -290045,10 +295372,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -290127,17 +295455,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -290149,7 +295477,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -290169,9 +295497,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -290179,10 +295509,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -290225,7 +295556,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -290306,11 +295637,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -290359,22 +295691,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -290387,14 +295721,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -290418,7 +295753,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -290485,10 +295820,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -290496,7 +295831,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -290524,15 +295866,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -290541,7 +295884,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -290650,8 +295994,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -290703,8 +296047,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -290718,8 +296062,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -290774,7 +296118,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -290813,8 +296158,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -291025,10 +296370,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -291107,17 +296453,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -291129,7 +296475,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -291149,9 +296495,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -291159,10 +296507,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -291205,7 +296554,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -291286,11 +296635,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -291339,22 +296689,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -291367,14 +296719,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -291398,7 +296751,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -291465,10 +296818,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -291476,7 +296829,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -291504,15 +296864,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -291521,7 +296882,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -291630,8 +296992,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -291683,8 +297045,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -291698,8 +297060,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -291754,7 +297116,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -291793,8 +297156,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -292005,10 +297368,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -292087,17 +297451,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -292109,7 +297473,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -292129,9 +297493,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -292139,10 +297505,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -292185,7 +297552,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -292266,11 +297633,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -292319,22 +297687,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -292347,14 +297717,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -292378,7 +297749,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -292445,10 +297816,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -292456,7 +297827,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -292484,15 +297862,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -292501,7 +297880,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -292610,8 +297990,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -292663,8 +298043,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -292678,8 +298058,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -292734,7 +298114,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -292773,8 +298154,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -292985,10 +298366,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -293067,17 +298449,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -293089,7 +298471,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -293109,9 +298491,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -293119,10 +298503,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -293165,7 +298550,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -293246,11 +298631,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -293299,22 +298685,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -293327,14 +298715,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -293358,7 +298747,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -293425,10 +298814,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -293436,7 +298825,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -293464,15 +298860,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -293481,7 +298878,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -293590,8 +298988,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -293643,8 +299041,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -293658,8 +299056,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -293714,7 +299112,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -293753,8 +299152,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -293965,10 +299364,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -294047,17 +299447,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -294069,7 +299469,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -294089,9 +299489,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -294099,10 +299501,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -294145,7 +299548,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -294226,11 +299629,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -294279,22 +299683,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -294307,14 +299713,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -294338,7 +299745,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -294405,10 +299812,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -294416,7 +299823,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -294444,15 +299858,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -294461,7 +299876,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -294570,8 +299986,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -294623,8 +300039,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -294638,8 +300054,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -294694,7 +300110,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -294733,8 +300150,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -294945,10 +300362,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -295027,17 +300445,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -295049,7 +300467,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -295069,9 +300487,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -295079,10 +300499,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -295125,7 +300546,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -295206,11 +300627,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -295259,22 +300681,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -295287,14 +300711,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -295318,7 +300743,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -295385,10 +300810,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -295396,7 +300821,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -295424,15 +300856,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -295441,7 +300874,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -295550,8 +300984,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -295603,8 +301037,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -295618,8 +301052,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -295674,7 +301108,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -295713,8 +301148,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -295925,10 +301360,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -296007,17 +301443,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -296029,7 +301465,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -296049,9 +301485,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -296059,10 +301497,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -296105,7 +301544,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -296186,11 +301625,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -296239,22 +301679,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -296267,14 +301709,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -296298,7 +301741,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -296365,10 +301808,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -296376,7 +301819,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -296404,15 +301854,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -296421,7 +301872,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -296530,8 +301982,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -296583,8 +302035,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -296598,8 +302050,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -296654,7 +302106,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -296693,8 +302146,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -296905,10 +302358,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -296987,17 +302441,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -297009,7 +302463,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -297029,9 +302483,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -297039,10 +302495,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -297085,7 +302542,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -297166,11 +302623,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -297219,22 +302677,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -297247,14 +302707,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -297278,7 +302739,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -297345,10 +302806,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -297356,7 +302817,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -297384,15 +302852,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -297401,7 +302870,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -297510,8 +302980,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -297563,8 +303033,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -297578,8 +303048,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -297634,7 +303104,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -297673,8 +303144,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -297885,10 +303356,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -297967,17 +303439,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -297989,7 +303461,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -298009,9 +303481,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -298019,10 +303493,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -298065,7 +303540,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -298146,11 +303621,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -298199,22 +303675,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -298227,14 +303705,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -298258,7 +303737,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -298325,10 +303804,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -298336,7 +303815,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -298364,15 +303850,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -298381,7 +303868,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -298490,8 +303978,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -298543,8 +304031,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -298558,8 +304046,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -298614,7 +304102,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -298653,8 +304142,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -298865,10 +304354,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -298947,17 +304437,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -298969,7 +304459,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -298989,9 +304479,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -298999,10 +304491,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -299045,7 +304538,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -299126,11 +304619,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -299179,22 +304673,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -299207,14 +304703,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -299238,7 +304735,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -299305,10 +304802,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -299316,7 +304813,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -299344,15 +304848,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -299361,7 +304866,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -299470,8 +304976,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -299523,8 +305029,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -299538,8 +305044,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -299594,7 +305100,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -299633,8 +305140,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -299845,10 +305352,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -299927,17 +305435,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -299949,7 +305457,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -299969,9 +305477,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -299979,10 +305489,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -300025,7 +305536,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -300106,11 +305617,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -300159,22 +305671,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -300187,14 +305701,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -300218,7 +305733,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -300285,10 +305800,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -300296,7 +305811,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -300324,15 +305846,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -300341,7 +305864,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -300450,8 +305974,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -300503,8 +306027,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -300518,8 +306042,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -300574,7 +306098,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -300613,8 +306138,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -300825,10 +306350,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -300907,17 +306433,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -300929,7 +306455,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -300949,9 +306475,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -300959,10 +306487,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -301005,7 +306534,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -301086,11 +306615,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -301139,22 +306669,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -301167,14 +306699,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -301198,7 +306731,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -301265,10 +306798,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -301276,7 +306809,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -301304,15 +306844,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -301321,7 +306862,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -301430,8 +306972,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -301483,8 +307025,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -301498,8 +307040,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -301554,7 +307096,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -301593,8 +307136,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -301805,10 +307348,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -301887,17 +307431,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -301909,7 +307453,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -301929,9 +307473,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -301939,10 +307485,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -301985,7 +307532,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -302066,11 +307613,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -302119,22 +307667,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -302147,14 +307697,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -302178,7 +307729,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -302245,10 +307796,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -302256,7 +307807,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -302284,15 +307842,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -302301,7 +307860,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -302410,8 +307970,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -302463,8 +308023,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -302478,8 +308038,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -302534,7 +308094,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -302573,8 +308134,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -302785,10 +308346,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -302867,17 +308429,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -302889,7 +308451,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -302909,9 +308471,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -302919,10 +308483,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -302965,7 +308530,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -303046,11 +308611,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -303099,22 +308665,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -303127,14 +308695,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -303158,7 +308727,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -303225,10 +308794,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -303236,7 +308805,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -303264,15 +308840,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -303281,7 +308858,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -303390,8 +308968,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -303443,8 +309021,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -303458,8 +309036,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -303514,7 +309092,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -303553,8 +309132,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -303765,10 +309344,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -303847,17 +309427,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -303869,7 +309449,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -303889,9 +309469,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -303899,10 +309481,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -303945,7 +309528,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -304026,11 +309609,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -304079,22 +309663,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -304107,14 +309693,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -304138,7 +309725,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -304205,10 +309792,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -304216,7 +309803,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -304244,15 +309838,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -304261,7 +309856,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -304370,8 +309966,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -304423,8 +310019,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -304438,8 +310034,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -304494,7 +310090,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -304533,8 +310130,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -304745,10 +310342,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -304827,17 +310425,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -304849,7 +310447,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -304869,9 +310467,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -304879,10 +310479,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -304925,7 +310526,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -305006,11 +310607,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -305059,22 +310661,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -305087,14 +310691,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -305118,7 +310723,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -305185,10 +310790,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -305196,7 +310801,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -305224,15 +310836,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -305241,7 +310854,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -305350,8 +310964,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -305403,8 +311017,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -305418,8 +311032,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -305474,7 +311088,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -305513,8 +311128,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -305725,10 +311340,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -305807,17 +311423,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -305829,7 +311445,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -305849,9 +311465,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -305859,10 +311477,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -305905,7 +311524,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -305986,11 +311605,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -306039,22 +311659,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -306067,14 +311689,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -306098,7 +311721,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -306165,10 +311788,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -306176,7 +311799,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -306204,15 +311834,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -306221,7 +311852,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -306330,8 +311962,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -306383,8 +312015,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -306398,8 +312030,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -306454,7 +312086,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -306493,8 +312126,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -306705,10 +312338,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -306787,17 +312421,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -306809,7 +312443,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -306829,9 +312463,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -306839,10 +312475,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -306885,7 +312522,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -306966,11 +312603,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -307019,22 +312657,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -307047,14 +312687,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -307078,7 +312719,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -307145,10 +312786,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -307156,7 +312797,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -307184,15 +312832,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -307201,7 +312850,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -307310,8 +312960,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -307363,8 +313013,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -307378,8 +313028,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -307434,7 +313084,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -307473,8 +313124,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -307685,10 +313336,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -307767,17 +313419,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -307789,7 +313441,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -307809,9 +313461,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -307819,10 +313473,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -307865,7 +313520,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -307946,11 +313601,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -307999,22 +313655,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -308027,14 +313685,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -308058,7 +313717,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -308125,10 +313784,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -308136,7 +313795,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -308164,15 +313830,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -308181,7 +313848,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -308290,8 +313958,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -308343,8 +314011,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -308358,8 +314026,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -308414,7 +314082,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -308453,8 +314122,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -308665,10 +314334,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -308747,17 +314417,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -308769,7 +314439,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -308789,9 +314459,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -308799,10 +314471,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -308845,7 +314518,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -308926,11 +314599,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -308979,22 +314653,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -309007,14 +314683,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -309038,7 +314715,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -309105,10 +314782,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -309116,7 +314793,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -309144,15 +314828,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -309161,7 +314846,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -309270,8 +314956,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -309323,8 +315009,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -309338,8 +315024,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -309394,7 +315080,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -309433,8 +315120,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -309645,10 +315332,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -309727,17 +315415,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -309749,7 +315437,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -309769,9 +315457,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -309779,10 +315469,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -309825,7 +315516,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -309906,11 +315597,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -309959,22 +315651,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -309987,14 +315681,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -310018,7 +315713,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -310085,10 +315780,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -310096,7 +315791,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -310124,15 +315826,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -310141,7 +315844,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -310250,8 +315954,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -310303,8 +316007,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -310318,8 +316022,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -310374,7 +316078,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -310413,8 +316118,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -310625,10 +316330,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -310707,17 +316413,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -310729,7 +316435,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -310749,9 +316455,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -310759,10 +316467,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -310805,7 +316514,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -310886,11 +316595,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -310939,22 +316649,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -310967,14 +316679,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -310998,7 +316711,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -311065,10 +316778,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -311076,7 +316789,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -311104,15 +316824,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -311121,7 +316842,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -311230,8 +316952,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -311283,8 +317005,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -311298,8 +317020,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -311354,7 +317076,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -311393,8 +317116,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -311605,10 +317328,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -311687,17 +317411,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -311709,7 +317433,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -311729,9 +317453,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -311739,10 +317465,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -311785,7 +317512,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -311866,11 +317593,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -311919,22 +317647,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -311947,14 +317677,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -311978,7 +317709,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -312045,10 +317776,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -312056,7 +317787,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -312084,15 +317822,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -312101,7 +317840,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -312210,8 +317950,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -312263,8 +318003,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -312278,8 +318018,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -312334,7 +318074,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -312373,8 +318114,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -312585,10 +318326,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -312667,17 +318409,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -312689,7 +318431,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -312709,9 +318451,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -312719,10 +318463,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -312765,7 +318510,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -312846,11 +318591,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -312899,22 +318645,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -312927,14 +318675,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -312958,7 +318707,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -313025,10 +318774,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -313036,7 +318785,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -313064,15 +318820,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -313081,7 +318838,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -313190,8 +318948,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -313243,8 +319001,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -313258,8 +319016,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -313314,7 +319072,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -313353,8 +319112,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -313565,10 +319324,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -313647,17 +319407,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -313669,7 +319429,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -313689,9 +319449,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -313699,10 +319461,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -313745,7 +319508,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -313826,11 +319589,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -313879,22 +319643,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -313907,14 +319673,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -313938,7 +319705,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -314005,10 +319772,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -314016,7 +319783,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -314044,15 +319818,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -314061,7 +319836,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -314170,8 +319946,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -314223,8 +319999,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -314238,8 +320014,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -314294,7 +320070,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -314333,8 +320110,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -314545,10 +320322,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -314627,17 +320405,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -314649,7 +320427,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -314669,9 +320447,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -314679,10 +320459,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -314725,7 +320506,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -314806,11 +320587,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -314859,22 +320641,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -314887,14 +320671,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -314918,7 +320703,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -314985,10 +320770,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -314996,7 +320781,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -315024,15 +320816,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -315041,7 +320834,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -315150,8 +320944,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -315203,8 +320997,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -315218,8 +321012,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -315274,7 +321068,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -315313,8 +321108,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -315525,10 +321320,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -315607,17 +321403,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -315629,7 +321425,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -315649,9 +321445,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -315659,10 +321457,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -315705,7 +321504,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -315786,11 +321585,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -315839,22 +321639,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -315867,14 +321669,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -315898,7 +321701,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -315965,10 +321768,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -315976,7 +321779,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -316004,15 +321814,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -316021,7 +321832,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -316130,8 +321942,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -316183,8 +321995,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -316198,8 +322010,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -316254,7 +322066,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -316293,8 +322106,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -316505,10 +322318,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -316587,17 +322401,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -316609,7 +322423,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -316629,9 +322443,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -316639,10 +322455,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -316685,7 +322502,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -316766,11 +322583,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -316819,22 +322637,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -316847,14 +322667,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -316878,7 +322699,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -316945,10 +322766,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -316956,7 +322777,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -316984,15 +322812,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -317001,7 +322830,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -317110,8 +322940,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -317163,8 +322993,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -317178,8 +323008,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -317234,7 +323064,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -317273,8 +323104,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -317485,10 +323316,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -317567,17 +323399,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -317589,7 +323421,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -317609,9 +323441,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -317619,10 +323453,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -317665,7 +323500,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -317746,11 +323581,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -317799,22 +323635,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -317827,14 +323665,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -317858,7 +323697,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -317925,10 +323764,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -317936,7 +323775,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -317964,15 +323810,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -317981,7 +323828,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -318090,8 +323938,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -318143,8 +323991,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -318158,8 +324006,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -318214,7 +324062,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -318253,8 +324102,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -318465,10 +324314,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -318547,17 +324397,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -318569,7 +324419,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -318589,9 +324439,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -318599,10 +324451,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -318645,7 +324498,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -318726,11 +324579,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -318779,22 +324633,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -318807,14 +324663,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -318838,7 +324695,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -318905,10 +324762,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -318916,7 +324773,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -318944,15 +324808,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -318961,7 +324826,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -319070,8 +324936,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -319123,8 +324989,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -319138,8 +325004,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -319194,7 +325060,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -319233,8 +325100,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -319445,10 +325312,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -319527,17 +325395,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -319549,7 +325417,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -319569,9 +325437,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -319579,10 +325449,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -319625,7 +325496,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -319706,11 +325577,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -319759,22 +325631,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -319787,14 +325661,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -319818,7 +325693,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -319885,10 +325760,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -319896,7 +325771,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -319924,15 +325806,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -319941,7 +325824,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -320050,8 +325934,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -320103,8 +325987,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -320118,8 +326002,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -320174,7 +326058,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -320213,8 +326098,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -320425,10 +326310,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -320507,17 +326393,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -320529,7 +326415,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -320549,9 +326435,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -320559,10 +326447,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -320605,7 +326494,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -320686,11 +326575,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -320739,22 +326629,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -320767,14 +326659,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -320798,7 +326691,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -320865,10 +326758,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -320876,7 +326769,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -320904,15 +326804,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -320921,7 +326822,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -321030,8 +326932,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -321083,8 +326985,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -321098,8 +327000,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -321154,7 +327056,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -321193,8 +327096,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -321405,10 +327308,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -321487,17 +327391,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -321509,7 +327413,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -321529,9 +327433,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -321539,10 +327445,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -321585,7 +327492,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -321666,11 +327573,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -321719,22 +327627,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -321747,14 +327657,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -321778,7 +327689,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -321845,10 +327756,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -321856,7 +327767,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -321884,15 +327802,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -321901,7 +327820,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -322010,8 +327930,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -322063,8 +327983,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -322078,8 +327998,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -322134,7 +328054,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -322173,8 +328094,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -322385,10 +328306,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -322467,17 +328389,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -322489,7 +328411,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -322509,9 +328431,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -322519,10 +328443,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -322565,7 +328490,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -322646,11 +328571,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -322699,22 +328625,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -322727,14 +328655,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -322758,7 +328687,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -322825,10 +328754,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -322836,7 +328765,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -322864,15 +328800,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -322881,7 +328818,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -322990,8 +328928,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -323043,8 +328981,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -323058,8 +328996,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -323114,7 +329052,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -323153,8 +329092,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -323365,10 +329304,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -323447,17 +329387,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -323469,7 +329409,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -323489,9 +329429,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -323499,10 +329441,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -323545,7 +329488,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -323626,11 +329569,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -323679,22 +329623,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -323707,14 +329653,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -323738,7 +329685,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -323805,10 +329752,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -323816,7 +329763,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -323844,15 +329798,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -323861,7 +329816,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -323970,8 +329926,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -324023,8 +329979,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -324038,8 +329994,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -324094,7 +330050,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -324133,8 +330090,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -324345,10 +330302,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -324427,17 +330385,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -324449,7 +330407,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -324469,9 +330427,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -324479,10 +330439,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -324525,7 +330486,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -324606,11 +330567,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -324659,22 +330621,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -324687,14 +330651,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -324718,7 +330683,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -324785,10 +330750,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -324796,7 +330761,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -324824,15 +330796,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -324841,7 +330814,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -324950,8 +330924,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -325003,8 +330977,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -325018,8 +330992,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -325074,7 +331048,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -325113,8 +331088,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -325325,10 +331300,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -325407,17 +331383,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -325429,7 +331405,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -325449,9 +331425,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -325459,10 +331437,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -325505,7 +331484,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -325586,11 +331565,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -325639,22 +331619,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -325667,14 +331649,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -325698,7 +331681,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -325765,10 +331748,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -325776,7 +331759,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -325804,15 +331794,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -325821,7 +331812,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -325930,8 +331922,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -325983,8 +331975,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -325998,8 +331990,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -326054,7 +332046,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -326093,8 +332086,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -326305,10 +332298,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -326387,17 +332381,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -326409,7 +332403,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -326429,9 +332423,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -326439,10 +332435,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -326485,7 +332482,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -326566,11 +332563,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -326619,22 +332617,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -326647,14 +332647,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -326678,7 +332679,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -326745,10 +332746,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -326756,7 +332757,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -326784,15 +332792,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -326801,7 +332810,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -326910,8 +332920,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -326963,8 +332973,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -326978,8 +332988,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -327034,7 +333044,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -327073,8 +333084,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -327285,10 +333296,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -327367,17 +333379,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -327389,7 +333401,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -327409,9 +333421,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -327419,10 +333433,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -327465,7 +333480,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -327546,11 +333561,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -327599,22 +333615,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -327627,14 +333645,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -327658,7 +333677,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -327725,10 +333744,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -327736,7 +333755,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -327764,15 +333790,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -327781,7 +333808,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -327890,8 +333918,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -327943,8 +333971,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -327958,8 +333986,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -328014,7 +334042,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -328053,8 +334082,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -328265,10 +334294,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -328347,17 +334377,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -328369,7 +334399,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -328389,9 +334419,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -328399,10 +334431,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -328445,7 +334478,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -328526,11 +334559,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -328579,22 +334613,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -328607,14 +334643,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -328638,7 +334675,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -328705,10 +334742,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -328716,7 +334753,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -328744,15 +334788,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -328761,7 +334806,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -328870,8 +334916,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -328923,8 +334969,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -328938,8 +334984,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -328994,7 +335040,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -329033,8 +335080,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -329245,10 +335292,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -329327,17 +335375,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -329349,7 +335397,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -329369,9 +335417,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -329379,10 +335429,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -329425,7 +335476,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -329506,11 +335557,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -329559,22 +335611,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -329587,14 +335641,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -329618,7 +335673,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -329685,10 +335740,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -329696,7 +335751,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -329724,15 +335786,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -329741,7 +335804,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -329850,8 +335914,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -329903,8 +335967,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -329918,8 +335982,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -329974,7 +336038,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -330013,8 +336078,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -330225,10 +336290,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -330307,17 +336373,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -330329,7 +336395,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -330349,9 +336415,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -330359,10 +336427,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -330405,7 +336474,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -330486,11 +336555,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -330539,22 +336609,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -330567,14 +336639,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -330598,7 +336671,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -330665,10 +336738,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -330676,7 +336749,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -330704,15 +336784,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -330721,7 +336802,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -330830,8 +336912,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -330883,8 +336965,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -330898,8 +336980,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -330954,7 +337036,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -330993,8 +337076,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -331205,10 +337288,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -331287,17 +337371,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -331309,7 +337393,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -331329,9 +337413,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -331339,10 +337425,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -331385,7 +337472,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -331466,11 +337553,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -331519,22 +337607,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -331547,14 +337637,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -331578,7 +337669,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -331645,10 +337736,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -331656,7 +337747,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -331684,15 +337782,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -331701,7 +337800,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -331810,8 +337910,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -331863,8 +337963,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -331878,8 +337978,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -331934,7 +338034,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -331973,8 +338074,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -332185,10 +338286,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -332267,17 +338369,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -332289,7 +338391,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -332309,9 +338411,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -332319,10 +338423,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -332365,7 +338470,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -332446,11 +338551,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -332499,22 +338605,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -332527,14 +338635,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -332558,7 +338667,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -332625,10 +338734,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -332636,7 +338745,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -332664,15 +338780,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -332681,7 +338798,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -332790,8 +338908,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -332843,8 +338961,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -332858,8 +338976,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -332914,7 +339032,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -332953,8 +339072,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -333165,10 +339284,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -333247,17 +339367,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -333269,7 +339389,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -333289,9 +339409,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -333299,10 +339421,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -333345,7 +339468,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -333426,11 +339549,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -333479,22 +339603,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -333507,14 +339633,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -333538,7 +339665,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -333605,10 +339732,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -333616,7 +339743,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -333644,15 +339778,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -333661,7 +339796,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -333770,8 +339906,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -333823,8 +339959,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -333838,8 +339974,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -333894,7 +340030,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -333933,8 +340070,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -334145,10 +340282,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -334227,17 +340365,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -334249,7 +340387,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -334269,9 +340407,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -334279,10 +340419,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -334325,7 +340466,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -334406,11 +340547,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -334459,22 +340601,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -334487,14 +340631,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -334518,7 +340663,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -334585,10 +340730,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -334596,7 +340741,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -334624,15 +340776,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -334641,7 +340794,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -334750,8 +340904,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -334803,8 +340957,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -334818,8 +340972,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -334874,7 +341028,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -334913,8 +341068,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -335125,10 +341280,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -335207,17 +341363,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -335229,7 +341385,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -335249,9 +341405,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -335259,10 +341417,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -335305,7 +341464,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -335386,11 +341545,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -335439,22 +341599,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -335467,14 +341629,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -335498,7 +341661,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -335565,10 +341728,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -335576,7 +341739,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -335604,15 +341774,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -335621,7 +341792,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -335730,8 +341902,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -335783,8 +341955,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -335798,8 +341970,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -335854,7 +342026,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -335893,8 +342066,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -336105,10 +342278,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -336187,17 +342361,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -336209,7 +342383,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -336229,9 +342403,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -336239,10 +342415,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -336285,7 +342462,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -336366,11 +342543,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -336419,22 +342597,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -336447,14 +342627,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -336478,7 +342659,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -336545,10 +342726,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -336556,7 +342737,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -336584,15 +342772,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -336601,7 +342790,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -336710,8 +342900,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -336763,8 +342953,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -336778,8 +342968,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -336834,7 +343024,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -336873,8 +343064,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -337085,10 +343276,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -337167,17 +343359,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -337189,7 +343381,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -337209,9 +343401,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -337219,10 +343413,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -337265,7 +343460,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -337346,11 +343541,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -337399,22 +343595,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -337427,14 +343625,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -337458,7 +343657,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -337525,10 +343724,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -337536,7 +343735,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -337564,15 +343770,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -337581,7 +343788,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -337690,8 +343898,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -337743,8 +343951,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -337758,8 +343966,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -337814,7 +344022,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -337853,8 +344062,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -338065,10 +344274,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -338147,17 +344357,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -338169,7 +344379,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -338189,9 +344399,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -338199,10 +344411,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -338245,7 +344458,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -338326,11 +344539,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -338379,22 +344593,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -338407,14 +344623,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -338438,7 +344655,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -338505,10 +344722,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -338516,7 +344733,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -338544,15 +344768,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -338561,7 +344786,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -338670,8 +344896,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -338723,8 +344949,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -338738,8 +344964,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -338794,7 +345020,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -338833,8 +345060,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -339045,10 +345272,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -339127,17 +345355,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -339149,7 +345377,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -339169,9 +345397,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -339179,10 +345409,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -339225,7 +345456,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -339306,11 +345537,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -339359,22 +345591,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -339387,14 +345621,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -339418,7 +345653,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -339485,10 +345720,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -339496,7 +345731,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -339524,15 +345766,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -339541,7 +345784,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -339650,8 +345894,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -339703,8 +345947,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -339718,8 +345962,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -339774,7 +346018,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -339813,8 +346058,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -340025,10 +346270,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -340107,17 +346353,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -340129,7 +346375,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -340149,9 +346395,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -340159,10 +346407,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -340205,7 +346454,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -340286,11 +346535,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -340339,22 +346589,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -340367,14 +346619,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -340398,7 +346651,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -340465,10 +346718,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -340476,7 +346729,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -340504,15 +346764,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -340521,7 +346782,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -340630,8 +346892,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -340683,8 +346945,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -340698,8 +346960,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -340754,7 +347016,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -340793,8 +347056,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -341005,10 +347268,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -341087,17 +347351,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -341109,7 +347373,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -341129,9 +347393,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -341139,10 +347405,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -341185,7 +347452,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -341266,11 +347533,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -341319,22 +347587,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -341347,14 +347617,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -341378,7 +347649,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -341445,10 +347716,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -341456,7 +347727,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -341484,15 +347762,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -341501,7 +347780,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -341610,8 +347890,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -341663,8 +347943,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -341678,8 +347958,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -341734,7 +348014,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -341773,8 +348054,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -341985,10 +348266,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -342067,17 +348349,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -342089,7 +348371,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -342109,9 +348391,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -342119,10 +348403,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -342165,7 +348450,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -342246,11 +348531,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -342299,22 +348585,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -342327,14 +348615,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -342358,7 +348647,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -342425,10 +348714,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -342436,7 +348725,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -342464,15 +348760,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -342481,7 +348778,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -342590,8 +348888,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -342643,8 +348941,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -342658,8 +348956,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -342714,7 +349012,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -342753,8 +349052,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -342965,10 +349264,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -343047,17 +349347,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -343069,7 +349369,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -343089,9 +349389,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -343099,10 +349401,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -343145,7 +349448,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -343226,11 +349529,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -343279,22 +349583,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -343307,14 +349613,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -343338,7 +349645,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -343405,10 +349712,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -343416,7 +349723,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -343444,15 +349758,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -343461,7 +349776,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -343570,8 +349886,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -343623,8 +349939,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -343638,8 +349954,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -343694,7 +350010,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -343733,8 +350050,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -343945,10 +350262,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -344027,17 +350345,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -344049,7 +350367,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -344069,9 +350387,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -344079,10 +350399,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -344125,7 +350446,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -344206,11 +350527,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -344259,22 +350581,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -344287,14 +350611,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -344318,7 +350643,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -344385,10 +350710,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -344396,7 +350721,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -344424,15 +350756,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -344441,7 +350774,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -344550,8 +350884,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -344603,8 +350937,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -344618,8 +350952,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -344674,7 +351008,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -344713,8 +351048,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -344925,10 +351260,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -345007,17 +351343,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -345029,7 +351365,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -345049,9 +351385,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -345059,10 +351397,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -345105,7 +351444,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -345186,11 +351525,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -345239,22 +351579,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -345267,14 +351609,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -345298,7 +351641,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -345365,10 +351708,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -345376,7 +351719,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -345404,15 +351754,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -345421,7 +351772,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -345530,8 +351882,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -345583,8 +351935,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -345598,8 +351950,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -345654,7 +352006,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -345693,8 +352046,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -345905,10 +352258,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -345987,17 +352341,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -346009,7 +352363,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -346029,9 +352383,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -346039,10 +352395,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -346085,7 +352442,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -346166,11 +352523,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -346219,22 +352577,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -346247,14 +352607,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -346278,7 +352639,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -346345,10 +352706,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -346356,7 +352717,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -346384,15 +352752,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -346401,7 +352770,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -346510,8 +352880,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -346563,8 +352933,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -346578,8 +352948,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -346634,7 +353004,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -346673,8 +353044,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -346885,10 +353256,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -346967,17 +353339,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -346989,7 +353361,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -347009,9 +353381,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -347019,10 +353393,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -347065,7 +353440,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -347146,11 +353521,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -347199,22 +353575,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -347227,14 +353605,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -347258,7 +353637,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -347325,10 +353704,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -347336,7 +353715,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -347364,15 +353750,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -347381,7 +353768,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -347490,8 +353878,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -347543,8 +353931,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -347558,8 +353946,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -347614,7 +354002,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -347653,8 +354042,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -347865,10 +354254,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -347947,17 +354337,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -347969,7 +354359,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -347989,9 +354379,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -347999,10 +354391,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -348045,7 +354438,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -348126,11 +354519,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -348179,22 +354573,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -348207,14 +354603,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -348238,7 +354635,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -348305,10 +354702,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -348316,7 +354713,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -348344,15 +354748,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -348361,7 +354766,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -348470,8 +354876,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -348523,8 +354929,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -348538,8 +354944,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -348594,7 +355000,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -348633,8 +355040,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -348845,10 +355252,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -348927,17 +355335,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -348949,7 +355357,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -348969,9 +355377,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -348979,10 +355389,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -349025,7 +355436,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -349106,11 +355517,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -349159,22 +355571,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -349187,14 +355601,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -349218,7 +355633,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -349285,10 +355700,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -349296,7 +355711,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -349324,15 +355746,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -349341,7 +355764,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -349450,8 +355874,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -349503,8 +355927,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -349518,8 +355942,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -349574,7 +355998,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -349613,8 +356038,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -349825,10 +356250,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -349907,17 +356333,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -349929,7 +356355,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -349949,9 +356375,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -349959,10 +356387,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -350005,7 +356434,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -350086,11 +356515,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -350139,22 +356569,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -350167,14 +356599,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -350198,7 +356631,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -350265,10 +356698,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -350276,7 +356709,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -350304,15 +356744,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -350321,7 +356762,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -350430,8 +356872,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -350483,8 +356925,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -350498,8 +356940,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -350554,7 +356996,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -350593,8 +357036,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -350805,10 +357248,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -350887,17 +357331,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -350909,7 +357353,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -350929,9 +357373,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -350939,10 +357385,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -350985,7 +357432,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -351066,11 +357513,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -351119,22 +357567,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -351147,14 +357597,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -351178,7 +357629,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -351245,10 +357696,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -351256,7 +357707,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -351284,15 +357742,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -351301,7 +357760,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -351410,8 +357870,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -351463,8 +357923,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -351478,8 +357938,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -351534,7 +357994,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -351573,8 +358034,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -351785,10 +358246,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -351867,17 +358329,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -351889,7 +358351,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -351909,9 +358371,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -351919,10 +358383,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -351965,7 +358430,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -352046,11 +358511,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -352099,22 +358565,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -352127,14 +358595,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -352158,7 +358627,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -352225,10 +358694,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -352236,7 +358705,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -352264,15 +358740,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -352281,7 +358758,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -352390,8 +358868,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -352443,8 +358921,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -352458,8 +358936,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -352514,7 +358992,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -352553,8 +359032,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -352765,10 +359244,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -352847,17 +359327,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -352869,7 +359349,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -352889,9 +359369,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -352899,10 +359381,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -352945,7 +359428,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -353026,11 +359509,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -353079,22 +359563,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -353107,14 +359593,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -353138,7 +359625,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -353205,10 +359692,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -353216,7 +359703,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -353244,15 +359738,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -353261,7 +359756,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -353370,8 +359866,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -353423,8 +359919,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -353438,8 +359934,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -353494,7 +359990,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -353533,8 +360030,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -353745,10 +360242,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -353827,17 +360325,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -353849,7 +360347,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -353869,9 +360367,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -353879,10 +360379,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -353925,7 +360426,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -354006,11 +360507,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -354059,22 +360561,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -354087,14 +360591,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -354118,7 +360623,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -354185,10 +360690,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -354196,7 +360701,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -354224,15 +360736,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -354241,7 +360754,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -354350,8 +360864,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -354403,8 +360917,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -354418,8 +360932,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -354474,7 +360988,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -354513,8 +361028,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -354725,10 +361240,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -354807,17 +361323,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -354829,7 +361345,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -354849,9 +361365,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -354859,10 +361377,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -354905,7 +361424,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -354986,11 +361505,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -355039,22 +361559,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -355067,14 +361589,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -355098,7 +361621,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -355165,10 +361688,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -355176,7 +361699,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -355204,15 +361734,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -355221,7 +361752,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -355330,8 +361862,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -355383,8 +361915,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -355398,8 +361930,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -355454,7 +361986,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -355493,8 +362026,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -355705,10 +362238,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -355787,17 +362321,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -355809,7 +362343,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -355829,9 +362363,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -355839,10 +362375,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -355885,7 +362422,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -355966,11 +362503,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -356019,22 +362557,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -356047,14 +362587,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -356078,7 +362619,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -356145,10 +362686,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -356156,7 +362697,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -356184,15 +362732,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -356201,7 +362750,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -356310,8 +362860,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -356363,8 +362913,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -356378,8 +362928,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -356434,7 +362984,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -356473,8 +363024,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -356685,10 +363236,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -356767,17 +363319,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -356789,7 +363341,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -356809,9 +363361,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -356819,10 +363373,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -356865,7 +363420,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -356946,11 +363501,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -356999,22 +363555,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -357027,14 +363585,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -357058,7 +363617,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -357125,10 +363684,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -357136,7 +363695,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -357164,15 +363730,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -357181,7 +363748,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -357290,8 +363858,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -357343,8 +363911,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -357358,8 +363926,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -357414,7 +363982,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -357453,8 +364022,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -357665,10 +364234,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -357747,17 +364317,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -357769,7 +364339,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -357789,9 +364359,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -357799,10 +364371,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -357845,7 +364418,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -357926,11 +364499,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -357979,22 +364553,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -358007,14 +364583,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -358038,7 +364615,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -358105,10 +364682,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -358116,7 +364693,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -358144,15 +364728,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -358161,7 +364746,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -358270,8 +364856,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -358323,8 +364909,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -358338,8 +364924,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -358394,7 +364980,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -358433,8 +365020,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -358645,10 +365232,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
@@ -358727,17 +365315,17 @@ T1222.002,No,-,0
 T1110.001,No,-,0
 T1216.001,No,-,0
 T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
 T1129,No,-,0
 T1602,No,-,0
 T1561.002,No,-,0
@@ -358749,7 +365337,7 @@ T1006,No,-,0
 T1044,No,-,0
 T1491.002,No,-,0
 T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
 T1499.001,No,-,0
 T1014,No,-,0
 T1546.013,No,-,0
@@ -358769,9 +365357,11 @@ T1546.006,No,-,0
 T1539,No,-,0
 T1053.007,No,-,0
 T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
 T1099,No,-,0
 T1016.001,No,-,0
 T1548.003,No,-,0
@@ -358779,10 +365369,11 @@ T1560.003,No,-,0
 T1578,No,-,0
 T1069,No,-,1
 T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
 T1596.002,No,-,0
 T1542.001,No,-,0
 T1594,No,-,0
@@ -358825,7 +365416,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
 T1587.001,No,-,0
 T1121,No,-,0
 T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
 T1547.014,No,-,0
 T1564,No,-,2
 T1559.002,No,-,0
@@ -358906,11 +365497,12 @@ T1505.002,No,-,0
 T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
 T1071,No,-,3
 T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
 T1218.007,No,-,0
 T1162,No,-,0
 T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -358959,22 +365551,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
 T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
 T1139,No,-,0
 T1205,No,-,0
 T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
 T1153,No,-,0
 T1038,No,-,0
 T1050,No,-,0
@@ -358987,14 +365581,15 @@ T1087.003,No,-,0
 T1062,No,-,0
 T1497.003,No,-,0
 T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1563.001,No,-,0
 T1562.002,No,-,0
 T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
 T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
 T1572,No,-,0
 T1218.002,No,-,0
@@ -359018,7 +365613,7 @@ T1152,No,-,0
 T1553.003,No,-,0
 T1483,No,-,0
 T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
 T1071.003,No,-,0
 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
 T1596,No,-,0
@@ -359085,10 +365680,10 @@ T1053.001,No,-,0
 T1179,No,-,0
 T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
 T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
 T1134.002,No,-,0
 T1548.001,No,-,0
 T1547.004,No,-,0
@@ -359096,7 +365691,14 @@ T1019,No,-,0
 T1021.003,No,-,0
 T1042,No,-,0
 T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
 T1090.002,No,-,0
 T1056.003,No,-,0
 T1589.002,No,-,0
@@ -359124,15 +365726,16 @@ T1574.005,No,-,0
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
 T1504,No,-,0
 T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
 T1562.006,No,-,0
 T1136.002,No,-,0
 T1589.003,No,-,0
@@ -359141,7 +365744,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
 T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
 T1558.001,No,-,0
 T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
 T1592.004,No,-,0
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -359250,8 +365854,8 @@ T1015,No,-,0
 T1212,No,-,0
 T1546.014,No,-,0
 T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
 T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
 T1502,No,-,0
 T1142,No,-,0
@@ -359303,8 +365907,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
 T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
 T1059.004,No,-,0
 T1137.003,No,-,0
 T1157,No,-,0
@@ -359318,8 +365922,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
 T1565,No,-,0
@@ -359374,7 +365978,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1531,No,-,0
 T1110.004,No,-,0
 T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
 T1036.001,No,-,0
 T1564.006,No,-,0
@@ -359413,8 +366018,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1195.002,No,-,0
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -359625,10 +366230,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
 T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
 T1056.004,No,-,0
 T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
 T1546.007,No,-,0
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
 T1090.001,No,-,0
diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json
index e5b83e474e..1620776bdd 100644
--- a/docs/mitre-map/coverage.json
+++ b/docs/mitre-map/coverage.json
@@ -59,7 +59,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -73,7 +73,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -99,8 +103,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -115,8 +119,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -177,7 +181,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -279,8 +287,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -368,8 +376,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -387,14 +395,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -428,7 +440,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -520,7 +532,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -534,7 +546,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -576,14 +592,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -595,7 +611,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -742,7 +762,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -811,7 +831,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -820,7 +840,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -858,8 +878,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -917,7 +937,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -1189,8 +1209,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -1287,7 +1307,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -1301,7 +1321,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -1327,8 +1351,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -1343,8 +1367,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -1405,7 +1429,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -1507,8 +1535,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -1596,8 +1624,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -1615,14 +1643,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -1656,7 +1688,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -1748,7 +1780,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -1762,7 +1794,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -1804,14 +1840,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -1823,7 +1859,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -1970,7 +2010,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -2039,7 +2079,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -2048,7 +2088,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -2086,8 +2126,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -2145,7 +2185,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -2417,8 +2457,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -2515,7 +2555,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -2529,7 +2569,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -2555,8 +2599,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -2571,8 +2615,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -2633,7 +2677,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -2735,8 +2783,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -2824,8 +2872,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -2843,14 +2891,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -2884,7 +2936,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -2976,7 +3028,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -2990,7 +3042,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -3032,14 +3088,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -3051,7 +3107,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -3198,7 +3258,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -3267,7 +3327,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -3276,7 +3336,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -3314,8 +3374,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -3373,7 +3433,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -3645,8 +3705,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -3743,7 +3803,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -3757,7 +3817,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -3783,8 +3847,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -3799,8 +3863,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -3861,7 +3925,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -3963,8 +4031,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -4052,8 +4120,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -4071,14 +4139,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -4112,7 +4184,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -4204,7 +4276,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -4218,7 +4290,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -4260,14 +4336,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -4279,7 +4355,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -4426,7 +4506,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -4495,7 +4575,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -4504,7 +4584,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -4542,8 +4622,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -4601,7 +4681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -4873,8 +4953,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -4971,7 +5051,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -4985,7 +5065,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -5011,8 +5095,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -5027,8 +5111,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -5089,7 +5173,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -5191,8 +5279,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -5280,8 +5368,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -5299,14 +5387,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -5340,7 +5432,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -5432,7 +5524,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -5446,7 +5538,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -5488,14 +5584,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -5507,7 +5603,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -5654,7 +5754,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -5723,7 +5823,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -5732,7 +5832,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -5770,8 +5870,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -5829,7 +5929,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -6101,8 +6201,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -6199,7 +6299,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -6213,7 +6313,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -6239,8 +6343,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -6255,8 +6359,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -6317,7 +6421,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -6419,8 +6527,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -6508,8 +6616,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -6527,14 +6635,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -6568,7 +6680,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -6660,7 +6772,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -6674,7 +6786,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -6716,14 +6832,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -6735,7 +6851,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -6882,7 +7002,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -6951,7 +7071,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -6960,7 +7080,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -6998,8 +7118,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -7057,7 +7177,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -7329,8 +7449,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -7427,7 +7547,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -7441,7 +7561,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -7467,8 +7591,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -7483,8 +7607,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -7545,7 +7669,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -7647,8 +7775,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -7736,8 +7864,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -7755,14 +7883,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -7796,7 +7928,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -7888,7 +8020,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -7902,7 +8034,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -7944,14 +8080,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -7963,7 +8099,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -8110,7 +8250,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -8179,7 +8319,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -8188,7 +8328,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -8226,8 +8366,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -8285,7 +8425,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -8557,8 +8697,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -8655,7 +8795,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -8669,7 +8809,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -8695,8 +8839,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -8711,8 +8855,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -8773,7 +8917,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -8875,8 +9023,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -8964,8 +9112,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -8983,14 +9131,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -9024,7 +9176,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -9116,7 +9268,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -9130,7 +9282,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -9172,14 +9328,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -9191,7 +9347,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -9338,7 +9498,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -9407,7 +9567,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -9416,7 +9576,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -9454,8 +9614,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -9513,7 +9673,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -9785,8 +9945,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -9883,7 +10043,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -9897,7 +10057,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -9923,8 +10087,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -9939,8 +10103,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -10001,7 +10165,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -10103,8 +10271,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -10192,8 +10360,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -10211,14 +10379,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -10252,7 +10424,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -10344,7 +10516,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -10358,7 +10530,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -10400,14 +10576,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -10419,7 +10595,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -10566,7 +10746,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -10635,7 +10815,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -10644,7 +10824,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -10682,8 +10862,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -10741,7 +10921,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -11013,8 +11193,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -11111,7 +11291,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -11125,7 +11305,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -11151,8 +11335,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -11167,8 +11351,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -11229,7 +11413,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -11331,8 +11519,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -11420,8 +11608,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -11439,14 +11627,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -11480,7 +11672,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -11572,7 +11764,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -11586,7 +11778,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -11628,14 +11824,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -11647,7 +11843,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -11794,7 +11994,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -11863,7 +12063,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -11872,7 +12072,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -11910,8 +12110,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -11969,7 +12169,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -12241,8 +12441,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -12339,7 +12539,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -12353,7 +12553,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -12379,8 +12583,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -12395,8 +12599,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -12457,7 +12661,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -12559,8 +12767,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -12648,8 +12856,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -12667,14 +12875,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -12708,7 +12920,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -12800,7 +13012,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -12814,7 +13026,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -12856,14 +13072,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -12875,7 +13091,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -13022,7 +13242,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -13091,7 +13311,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -13100,7 +13320,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -13138,8 +13358,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -13197,7 +13417,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -13469,8 +13689,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -13567,7 +13787,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -13581,7 +13801,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -13607,8 +13831,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -13623,8 +13847,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -13685,7 +13909,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -13787,8 +14015,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -13876,8 +14104,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -13895,14 +14123,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -13936,7 +14168,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -14028,7 +14260,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -14042,7 +14274,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -14084,14 +14320,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -14103,7 +14339,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -14250,7 +14490,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -14319,7 +14559,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -14328,7 +14568,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -14366,8 +14606,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -14425,7 +14665,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -14697,8 +14937,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -14795,7 +15035,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -14809,7 +15049,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -14835,8 +15079,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -14851,8 +15095,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -14913,7 +15157,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -15015,8 +15263,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -15104,8 +15352,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -15123,14 +15371,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -15164,7 +15416,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -15256,7 +15508,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -15270,7 +15522,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -15312,14 +15568,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -15331,7 +15587,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -15478,7 +15738,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -15547,7 +15807,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -15556,7 +15816,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -15594,8 +15854,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -15653,7 +15913,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -15925,8 +16185,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -16023,7 +16283,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -16037,7 +16297,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -16063,8 +16327,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -16079,8 +16343,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -16141,7 +16405,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -16243,8 +16511,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -16332,8 +16600,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -16351,14 +16619,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -16392,7 +16664,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -16484,7 +16756,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -16498,7 +16770,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -16540,14 +16816,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -16559,7 +16835,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -16706,7 +16986,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -16775,7 +17055,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -16784,7 +17064,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -16822,8 +17102,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -16881,7 +17161,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -17153,8 +17433,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -17251,7 +17531,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -17265,7 +17545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -17291,8 +17575,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -17307,8 +17591,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -17369,7 +17653,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -17471,8 +17759,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -17560,8 +17848,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -17579,14 +17867,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -17620,7 +17912,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -17712,7 +18004,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -17726,7 +18018,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -17768,14 +18064,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -17787,7 +18083,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -17934,7 +18234,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -18003,7 +18303,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -18012,7 +18312,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -18050,8 +18350,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -18109,7 +18409,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -18381,8 +18681,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -18479,7 +18779,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -18493,7 +18793,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -18519,8 +18823,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -18535,8 +18839,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -18597,7 +18901,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -18699,8 +19007,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -18788,8 +19096,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -18807,14 +19115,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -18848,7 +19160,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -18940,7 +19252,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -18954,7 +19266,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -18996,14 +19312,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -19015,7 +19331,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -19162,7 +19482,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -19231,7 +19551,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -19240,7 +19560,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -19278,8 +19598,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -19337,7 +19657,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -19609,8 +19929,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -19707,7 +20027,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -19721,7 +20041,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -19747,8 +20071,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -19763,8 +20087,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -19825,7 +20149,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -19927,8 +20255,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -20016,8 +20344,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -20035,14 +20363,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -20076,7 +20408,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -20168,7 +20500,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -20182,7 +20514,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -20224,14 +20560,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -20243,7 +20579,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -20390,7 +20730,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -20459,7 +20799,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -20468,7 +20808,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -20506,8 +20846,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -20565,7 +20905,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -20837,8 +21177,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -20935,7 +21275,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -20949,7 +21289,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -20975,8 +21319,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -20991,8 +21335,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -21053,7 +21397,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -21155,8 +21503,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -21244,8 +21592,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -21263,14 +21611,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -21304,7 +21656,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -21396,7 +21748,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -21410,7 +21762,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -21452,14 +21808,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -21471,7 +21827,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -21618,7 +21978,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -21687,7 +22047,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -21696,7 +22056,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -21734,8 +22094,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -21793,7 +22153,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -22065,8 +22425,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -22163,7 +22523,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -22177,7 +22537,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -22203,8 +22567,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -22219,8 +22583,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -22281,7 +22645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -22383,8 +22751,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -22472,8 +22840,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -22491,14 +22859,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -22532,7 +22904,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -22624,7 +22996,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -22638,7 +23010,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -22680,14 +23056,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -22699,7 +23075,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -22846,7 +23226,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -22915,7 +23295,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -22924,7 +23304,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -22962,8 +23342,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -23021,7 +23401,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -23293,8 +23673,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -23391,7 +23771,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -23405,7 +23785,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -23431,8 +23815,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -23447,8 +23831,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -23509,7 +23893,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -23611,8 +23999,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -23700,8 +24088,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -23719,14 +24107,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -23760,7 +24152,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -23852,7 +24244,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -23866,7 +24258,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -23908,14 +24304,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -23927,7 +24323,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -24074,7 +24474,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -24143,7 +24543,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -24152,7 +24552,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -24190,8 +24590,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -24249,7 +24649,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -24521,8 +24921,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -24619,7 +25019,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -24633,7 +25033,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -24659,8 +25063,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -24675,8 +25079,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -24737,7 +25141,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -24839,8 +25247,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -24928,8 +25336,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -24947,14 +25355,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -24988,7 +25400,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -25080,7 +25492,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -25094,7 +25506,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -25136,14 +25552,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -25155,7 +25571,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -25302,7 +25722,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -25371,7 +25791,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -25380,7 +25800,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -25418,8 +25838,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -25477,7 +25897,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -25749,8 +26169,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -25847,7 +26267,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -25861,7 +26281,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -25887,8 +26311,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -25903,8 +26327,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -25965,7 +26389,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -26067,8 +26495,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -26156,8 +26584,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -26175,14 +26603,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -26216,7 +26648,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -26308,7 +26740,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -26322,7 +26754,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -26364,14 +26800,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -26383,7 +26819,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -26530,7 +26970,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -26599,7 +27039,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -26608,7 +27048,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -26646,8 +27086,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -26705,7 +27145,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -26977,8 +27417,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -27075,7 +27515,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -27089,7 +27529,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -27115,8 +27559,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -27131,8 +27575,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -27193,7 +27637,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -27295,8 +27743,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -27384,8 +27832,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -27403,14 +27851,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -27444,7 +27896,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -27536,7 +27988,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -27550,7 +28002,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -27592,14 +28048,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -27611,7 +28067,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -27758,7 +28218,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -27827,7 +28287,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -27836,7 +28296,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -27874,8 +28334,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -27933,7 +28393,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -28205,8 +28665,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -28303,7 +28763,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -28317,7 +28777,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -28343,8 +28807,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -28359,8 +28823,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -28421,7 +28885,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -28523,8 +28991,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -28612,8 +29080,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -28631,14 +29099,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -28672,7 +29144,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -28764,7 +29236,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -28778,7 +29250,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -28820,14 +29296,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -28839,7 +29315,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -28986,7 +29466,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -29055,7 +29535,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -29064,7 +29544,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -29102,8 +29582,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -29161,7 +29641,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -29433,8 +29913,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -29531,7 +30011,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -29545,7 +30025,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -29571,8 +30055,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -29587,8 +30071,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -29649,7 +30133,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -29751,8 +30239,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -29840,8 +30328,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -29859,14 +30347,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -29900,7 +30392,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -29992,7 +30484,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -30006,7 +30498,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -30048,14 +30544,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -30067,7 +30563,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -30214,7 +30714,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -30283,7 +30783,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -30292,7 +30792,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -30330,8 +30830,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -30389,7 +30889,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -30661,8 +31161,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -30759,7 +31259,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -30773,7 +31273,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -30799,8 +31303,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -30815,8 +31319,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -30877,7 +31381,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -30979,8 +31487,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -31068,8 +31576,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -31087,14 +31595,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -31128,7 +31640,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -31220,7 +31732,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -31234,7 +31746,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -31276,14 +31792,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -31295,7 +31811,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -31442,7 +31962,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -31511,7 +32031,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -31520,7 +32040,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -31558,8 +32078,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -31617,7 +32137,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -31889,8 +32409,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -31987,7 +32507,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -32001,7 +32521,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -32027,8 +32551,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -32043,8 +32567,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -32105,7 +32629,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -32207,8 +32735,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -32296,8 +32824,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -32315,14 +32843,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -32356,7 +32888,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -32448,7 +32980,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -32462,7 +32994,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -32504,14 +33040,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -32523,7 +33059,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -32670,7 +33210,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -32739,7 +33279,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -32748,7 +33288,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -32786,8 +33326,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -32845,7 +33385,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -33117,8 +33657,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -33215,7 +33755,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -33229,7 +33769,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -33255,8 +33799,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -33271,8 +33815,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -33333,7 +33877,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -33435,8 +33983,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -33524,8 +34072,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -33543,14 +34091,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -33584,7 +34136,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -33676,7 +34228,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -33690,7 +34242,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -33732,14 +34288,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -33751,7 +34307,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -33898,7 +34458,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -33967,7 +34527,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -33976,7 +34536,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -34014,8 +34574,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -34073,7 +34633,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -34345,8 +34905,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -34443,7 +35003,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -34457,7 +35017,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -34483,8 +35047,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -34499,8 +35063,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -34561,7 +35125,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -34663,8 +35231,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -34752,8 +35320,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -34771,14 +35339,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -34812,7 +35384,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -34904,7 +35476,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -34918,7 +35490,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -34960,14 +35536,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -34979,7 +35555,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -35126,7 +35706,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -35195,7 +35775,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -35204,7 +35784,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -35242,8 +35822,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -35301,7 +35881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -35573,8 +36153,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -35671,7 +36251,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -35685,7 +36265,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -35711,8 +36295,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -35727,8 +36311,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -35789,7 +36373,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -35891,8 +36479,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -35980,8 +36568,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -35999,14 +36587,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -36040,7 +36632,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -36132,7 +36724,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -36146,7 +36738,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -36188,14 +36784,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -36207,7 +36803,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -36354,7 +36954,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -36423,7 +37023,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -36432,7 +37032,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -36470,8 +37070,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -36529,7 +37129,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -36801,8 +37401,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -36899,7 +37499,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -36913,7 +37513,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -36939,8 +37543,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -36955,8 +37559,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -37017,7 +37621,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -37119,8 +37727,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -37208,8 +37816,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -37227,14 +37835,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -37268,7 +37880,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -37360,7 +37972,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -37374,7 +37986,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -37416,14 +38032,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -37435,7 +38051,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -37582,7 +38202,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -37651,7 +38271,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -37660,7 +38280,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -37698,8 +38318,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -37757,7 +38377,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -38029,8 +38649,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -38127,7 +38747,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -38141,7 +38761,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -38167,8 +38791,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -38183,8 +38807,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -38245,7 +38869,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -38347,8 +38975,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -38436,8 +39064,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -38455,14 +39083,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -38496,7 +39128,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -38588,7 +39220,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -38602,7 +39234,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -38644,14 +39280,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -38663,7 +39299,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -38810,7 +39450,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -38879,7 +39519,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -38888,7 +39528,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -38926,8 +39566,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -38985,7 +39625,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -39257,8 +39897,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -39355,7 +39995,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -39369,7 +40009,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -39395,8 +40039,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -39411,8 +40055,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -39473,7 +40117,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -39575,8 +40223,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -39664,8 +40312,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -39683,14 +40331,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -39724,7 +40376,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -39816,7 +40468,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -39830,7 +40482,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -39872,14 +40528,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -39891,7 +40547,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -40038,7 +40698,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -40107,7 +40767,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -40116,7 +40776,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -40154,8 +40814,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -40213,7 +40873,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -40485,8 +41145,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -40583,7 +41243,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -40597,7 +41257,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -40623,8 +41287,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -40639,8 +41303,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -40701,7 +41365,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -40803,8 +41471,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -40892,8 +41560,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -40911,14 +41579,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -40952,7 +41624,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -41044,7 +41716,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -41058,7 +41730,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -41100,14 +41776,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -41119,7 +41795,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -41266,7 +41946,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -41335,7 +42015,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -41344,7 +42024,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -41382,8 +42062,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -41441,7 +42121,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -41713,8 +42393,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -41811,7 +42491,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -41825,7 +42505,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -41851,8 +42535,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -41867,8 +42551,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -41929,7 +42613,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -42031,8 +42719,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -42120,8 +42808,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -42139,14 +42827,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -42180,7 +42872,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -42272,7 +42964,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -42286,7 +42978,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -42328,14 +43024,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -42347,7 +43043,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -42494,7 +43194,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -42563,7 +43263,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -42572,7 +43272,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -42610,8 +43310,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -42669,7 +43369,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -42941,8 +43641,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -43039,7 +43739,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -43053,7 +43753,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -43079,8 +43783,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -43095,8 +43799,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -43157,7 +43861,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -43259,8 +43967,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -43348,8 +44056,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -43367,14 +44075,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -43408,7 +44120,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -43500,7 +44212,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -43514,7 +44226,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -43556,14 +44272,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -43575,7 +44291,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -43722,7 +44442,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -43791,7 +44511,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -43800,7 +44520,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -43838,8 +44558,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -43897,7 +44617,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -44169,8 +44889,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -44267,7 +44987,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -44281,7 +45001,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -44307,8 +45031,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -44323,8 +45047,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -44385,7 +45109,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -44487,8 +45215,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -44576,8 +45304,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -44595,14 +45323,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -44636,7 +45368,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -44728,7 +45460,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -44742,7 +45474,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -44784,14 +45520,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -44803,7 +45539,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -44950,7 +45690,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -45019,7 +45759,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -45028,7 +45768,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -45066,8 +45806,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -45125,7 +45865,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -45397,8 +46137,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -45495,7 +46235,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -45509,7 +46249,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -45535,8 +46279,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -45551,8 +46295,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -45613,7 +46357,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -45715,8 +46463,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -45804,8 +46552,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -45823,14 +46571,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -45864,7 +46616,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -45956,7 +46708,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -45970,7 +46722,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -46012,14 +46768,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -46031,7 +46787,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -46178,7 +46938,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -46247,7 +47007,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -46256,7 +47016,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -46294,8 +47054,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -46353,7 +47113,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -46625,8 +47385,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -46723,7 +47483,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -46737,7 +47497,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -46763,8 +47527,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -46779,8 +47543,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -46841,7 +47605,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -46943,8 +47711,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -47032,8 +47800,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -47051,14 +47819,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -47092,7 +47864,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -47184,7 +47956,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -47198,7 +47970,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -47240,14 +48016,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -47259,7 +48035,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -47406,7 +48186,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -47475,7 +48255,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -47484,7 +48264,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -47522,8 +48302,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -47581,7 +48361,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -47853,8 +48633,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -47951,7 +48731,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -47965,7 +48745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -47991,8 +48775,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -48007,8 +48791,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -48069,7 +48853,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -48171,8 +48959,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -48260,8 +49048,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -48279,14 +49067,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -48320,7 +49112,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -48412,7 +49204,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -48426,7 +49218,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -48468,14 +49264,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -48487,7 +49283,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -48634,7 +49434,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -48703,7 +49503,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -48712,7 +49512,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -48750,8 +49550,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -48809,7 +49609,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -49081,8 +49881,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -49179,7 +49979,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -49193,7 +49993,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -49219,8 +50023,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -49235,8 +50039,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -49297,7 +50101,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -49399,8 +50207,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -49488,8 +50296,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -49507,14 +50315,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -49548,7 +50360,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -49640,7 +50452,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -49654,7 +50466,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -49696,14 +50512,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -49715,7 +50531,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -49862,7 +50682,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -49931,7 +50751,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -49940,7 +50760,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -49978,8 +50798,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -50037,7 +50857,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -50309,8 +51129,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -50407,7 +51227,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -50421,7 +51241,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -50447,8 +51271,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -50463,8 +51287,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -50525,7 +51349,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -50627,8 +51455,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -50716,8 +51544,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -50735,14 +51563,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -50776,7 +51608,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -50868,7 +51700,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -50882,7 +51714,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -50924,14 +51760,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -50943,7 +51779,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -51090,7 +51930,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -51159,7 +51999,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -51168,7 +52008,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -51206,8 +52046,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -51265,7 +52105,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -51537,8 +52377,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -51635,7 +52475,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -51649,7 +52489,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -51675,8 +52519,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -51691,8 +52535,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -51753,7 +52597,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -51855,8 +52703,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -51944,8 +52792,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -51963,14 +52811,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -52004,7 +52856,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -52096,7 +52948,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -52110,7 +52962,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -52152,14 +53008,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -52171,7 +53027,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -52318,7 +53178,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -52387,7 +53247,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -52396,7 +53256,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -52434,8 +53294,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -52493,7 +53353,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -52765,8 +53625,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -52863,7 +53723,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -52877,7 +53737,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -52903,8 +53767,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -52919,8 +53783,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -52981,7 +53845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -53083,8 +53951,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -53172,8 +54040,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -53191,14 +54059,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -53232,7 +54104,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -53324,7 +54196,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -53338,7 +54210,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -53380,14 +54256,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -53399,7 +54275,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -53546,7 +54426,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -53615,7 +54495,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -53624,7 +54504,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -53662,8 +54542,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -53721,7 +54601,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -53993,8 +54873,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -54091,7 +54971,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -54105,7 +54985,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -54131,8 +55015,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -54147,8 +55031,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -54209,7 +55093,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -54311,8 +55199,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -54400,8 +55288,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -54419,14 +55307,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -54460,7 +55352,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -54552,7 +55444,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -54566,7 +55458,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -54608,14 +55504,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -54627,7 +55523,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -54774,7 +55674,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -54843,7 +55743,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -54852,7 +55752,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -54890,8 +55790,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -54949,7 +55849,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -55221,8 +56121,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -55319,7 +56219,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -55333,7 +56233,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -55359,8 +56263,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -55375,8 +56279,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -55437,7 +56341,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -55539,8 +56447,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -55628,8 +56536,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -55647,14 +56555,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -55688,7 +56600,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -55780,7 +56692,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -55794,7 +56706,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -55836,14 +56752,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -55855,7 +56771,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -56002,7 +56922,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -56071,7 +56991,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -56080,7 +57000,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -56118,8 +57038,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -56177,7 +57097,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -56449,8 +57369,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -56547,7 +57467,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -56561,7 +57481,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -56587,8 +57511,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -56603,8 +57527,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -56665,7 +57589,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -56767,8 +57695,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -56856,8 +57784,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -56875,14 +57803,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -56916,7 +57848,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -57008,7 +57940,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -57022,7 +57954,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -57064,14 +58000,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -57083,7 +58019,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -57230,7 +58170,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -57299,7 +58239,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -57308,7 +58248,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -57346,8 +58286,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -57405,7 +58345,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -57677,8 +58617,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -57775,7 +58715,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -57789,7 +58729,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -57815,8 +58759,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -57831,8 +58775,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -57893,7 +58837,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -57995,8 +58943,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -58084,8 +59032,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -58103,14 +59051,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -58144,7 +59096,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -58236,7 +59188,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -58250,7 +59202,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -58292,14 +59248,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -58311,7 +59267,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -58458,7 +59418,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -58527,7 +59487,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -58536,7 +59496,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -58574,8 +59534,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -58633,7 +59593,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -58905,8 +59865,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -59003,7 +59963,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -59017,7 +59977,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -59043,8 +60007,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -59059,8 +60023,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -59121,7 +60085,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -59223,8 +60191,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -59312,8 +60280,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -59331,14 +60299,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -59372,7 +60344,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -59464,7 +60436,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -59478,7 +60450,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -59520,14 +60496,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -59539,7 +60515,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -59686,7 +60666,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -59755,7 +60735,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -59764,7 +60744,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -59802,8 +60782,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -59861,7 +60841,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -60133,8 +61113,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -60231,7 +61211,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -60245,7 +61225,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -60271,8 +61255,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -60287,8 +61271,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -60349,7 +61333,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -60451,8 +61439,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -60540,8 +61528,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -60559,14 +61547,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -60600,7 +61592,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -60692,7 +61684,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -60706,7 +61698,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -60748,14 +61744,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -60767,7 +61763,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -60914,7 +61914,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -60983,7 +61983,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -60992,7 +61992,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -61030,8 +62030,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -61089,7 +62089,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -61361,8 +62361,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -61459,7 +62459,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -61473,7 +62473,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -61499,8 +62503,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -61515,8 +62519,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -61577,7 +62581,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -61679,8 +62687,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -61768,8 +62776,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -61787,14 +62795,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -61828,7 +62840,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -61920,7 +62932,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -61934,7 +62946,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -61976,14 +62992,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -61995,7 +63011,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -62142,7 +63162,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -62211,7 +63231,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -62220,7 +63240,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -62258,8 +63278,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -62317,7 +63337,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -62589,8 +63609,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -62687,7 +63707,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -62701,7 +63721,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -62727,8 +63751,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -62743,8 +63767,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -62805,7 +63829,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -62907,8 +63935,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -62996,8 +64024,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -63015,14 +64043,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -63056,7 +64088,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -63148,7 +64180,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -63162,7 +64194,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -63204,14 +64240,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -63223,7 +64259,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -63370,7 +64410,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -63439,7 +64479,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -63448,7 +64488,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -63486,8 +64526,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -63545,7 +64585,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -63817,8 +64857,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -63915,7 +64955,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -63929,7 +64969,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -63955,8 +64999,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -63971,8 +65015,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -64033,7 +65077,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -64135,8 +65183,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -64224,8 +65272,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -64243,14 +65291,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -64284,7 +65336,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -64376,7 +65428,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -64390,7 +65442,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -64432,14 +65488,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -64451,7 +65507,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -64598,7 +65658,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -64667,7 +65727,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -64676,7 +65736,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -64714,8 +65774,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -64773,7 +65833,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -65045,8 +66105,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -65143,7 +66203,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -65157,7 +66217,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -65183,8 +66247,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -65199,8 +66263,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -65261,7 +66325,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -65363,8 +66431,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -65452,8 +66520,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -65471,14 +66539,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -65512,7 +66584,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -65604,7 +66676,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -65618,7 +66690,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -65660,14 +66736,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -65679,7 +66755,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -65826,7 +66906,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -65895,7 +66975,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -65904,7 +66984,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -65942,8 +67022,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -66001,7 +67081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -66273,8 +67353,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -66371,7 +67451,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -66385,7 +67465,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -66411,8 +67495,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -66427,8 +67511,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -66489,7 +67573,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -66591,8 +67679,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -66680,8 +67768,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -66699,14 +67787,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -66740,7 +67832,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -66832,7 +67924,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -66846,7 +67938,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -66888,14 +67984,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -66907,7 +68003,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -67054,7 +68154,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -67123,7 +68223,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -67132,7 +68232,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -67170,8 +68270,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -67229,7 +68329,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -67501,8 +68601,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -67599,7 +68699,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -67613,7 +68713,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -67639,8 +68743,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -67655,8 +68759,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -67717,7 +68821,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -67819,8 +68927,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -67908,8 +69016,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -67927,14 +69035,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -67968,7 +69080,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -68060,7 +69172,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -68074,7 +69186,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -68116,14 +69232,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -68135,7 +69251,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -68282,7 +69402,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -68351,7 +69471,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -68360,7 +69480,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -68398,8 +69518,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -68457,7 +69577,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -68729,8 +69849,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -68827,7 +69947,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -68841,7 +69961,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -68867,8 +69991,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -68883,8 +70007,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -68945,7 +70069,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -69047,8 +70175,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -69136,8 +70264,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -69155,14 +70283,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -69196,7 +70328,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -69288,7 +70420,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -69302,7 +70434,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -69344,14 +70480,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -69363,7 +70499,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -69510,7 +70650,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -69579,7 +70719,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -69588,7 +70728,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -69626,8 +70766,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -69685,7 +70825,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -69957,8 +71097,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -70055,7 +71195,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -70069,7 +71209,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -70095,8 +71239,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -70111,8 +71255,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -70173,7 +71317,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -70275,8 +71423,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -70364,8 +71512,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -70383,14 +71531,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -70424,7 +71576,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -70516,7 +71668,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -70530,7 +71682,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -70572,14 +71728,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -70591,7 +71747,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -70738,7 +71898,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -70807,7 +71967,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -70816,7 +71976,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -70854,8 +72014,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -70913,7 +72073,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -71185,8 +72345,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -71283,7 +72443,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -71297,7 +72457,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -71323,8 +72487,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -71339,8 +72503,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -71401,7 +72565,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -71503,8 +72671,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -71592,8 +72760,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -71611,14 +72779,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -71652,7 +72824,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -71744,7 +72916,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -71758,7 +72930,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -71800,14 +72976,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -71819,7 +72995,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -71966,7 +73146,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -72035,7 +73215,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -72044,7 +73224,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -72082,8 +73262,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -72141,7 +73321,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -72413,8 +73593,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -72511,7 +73691,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -72525,7 +73705,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -72551,8 +73735,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -72567,8 +73751,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -72629,7 +73813,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -72731,8 +73919,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -72820,8 +74008,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -72839,14 +74027,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -72880,7 +74072,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -72972,7 +74164,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -72986,7 +74178,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -73028,14 +74224,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -73047,7 +74243,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -73194,7 +74394,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -73263,7 +74463,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -73272,7 +74472,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -73310,8 +74510,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -73369,7 +74569,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -73641,8 +74841,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -73739,7 +74939,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -73753,7 +74953,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -73779,8 +74983,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -73795,8 +74999,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -73857,7 +75061,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -73959,8 +75167,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -74048,8 +75256,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -74067,14 +75275,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -74108,7 +75320,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -74200,7 +75412,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -74214,7 +75426,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -74256,14 +75472,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -74275,7 +75491,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -74422,7 +75642,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -74491,7 +75711,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -74500,7 +75720,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -74538,8 +75758,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -74597,7 +75817,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -74869,8 +76089,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -74967,7 +76187,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -74981,7 +76201,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -75007,8 +76231,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -75023,8 +76247,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -75085,7 +76309,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -75187,8 +76415,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -75276,8 +76504,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -75295,14 +76523,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -75336,7 +76568,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -75428,7 +76660,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -75442,7 +76674,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -75484,14 +76720,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -75503,7 +76739,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -75650,7 +76890,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -75719,7 +76959,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -75728,7 +76968,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -75766,8 +77006,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -75825,7 +77065,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -76097,8 +77337,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -76195,7 +77435,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -76209,7 +77449,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -76235,8 +77479,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -76251,8 +77495,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -76313,7 +77557,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -76415,8 +77663,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -76504,8 +77752,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -76523,14 +77771,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -76564,7 +77816,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -76656,7 +77908,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -76670,7 +77922,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -76712,14 +77968,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -76731,7 +77987,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -76878,7 +78138,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -76947,7 +78207,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -76956,7 +78216,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -76994,8 +78254,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -77053,7 +78313,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -77325,8 +78585,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -77423,7 +78683,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -77437,7 +78697,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -77463,8 +78727,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -77479,8 +78743,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -77541,7 +78805,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -77643,8 +78911,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -77732,8 +79000,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -77751,14 +79019,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -77792,7 +79064,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -77884,7 +79156,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -77898,7 +79170,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -77940,14 +79216,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -77959,7 +79235,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -78106,7 +79386,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -78175,7 +79455,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -78184,7 +79464,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -78222,8 +79502,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -78281,7 +79561,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -78553,8 +79833,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -78651,7 +79931,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -78665,7 +79945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -78691,8 +79975,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -78707,8 +79991,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -78769,7 +80053,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -78871,8 +80159,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -78960,8 +80248,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -78979,14 +80267,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -79020,7 +80312,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -79112,7 +80404,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -79126,7 +80418,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -79168,14 +80464,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -79187,7 +80483,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -79334,7 +80634,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -79403,7 +80703,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -79412,7 +80712,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -79450,8 +80750,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -79509,7 +80809,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -79781,8 +81081,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -79879,7 +81179,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -79893,7 +81193,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -79919,8 +81223,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -79935,8 +81239,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -79997,7 +81301,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -80099,8 +81407,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -80188,8 +81496,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -80207,14 +81515,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -80248,7 +81560,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -80340,7 +81652,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -80354,7 +81666,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -80396,14 +81712,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -80415,7 +81731,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -80562,7 +81882,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -80631,7 +81951,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -80640,7 +81960,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -80678,8 +81998,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -80737,7 +82057,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -81009,8 +82329,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -81107,7 +82427,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -81121,7 +82441,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -81147,8 +82471,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -81163,8 +82487,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -81225,7 +82549,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -81327,8 +82655,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -81416,8 +82744,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -81435,14 +82763,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -81476,7 +82808,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -81568,7 +82900,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -81582,7 +82914,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -81624,14 +82960,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -81643,7 +82979,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -81790,7 +83130,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -81859,7 +83199,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -81868,7 +83208,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -81906,8 +83246,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -81965,7 +83305,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -82237,8 +83577,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -82335,7 +83675,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -82349,7 +83689,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -82375,8 +83719,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -82391,8 +83735,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -82453,7 +83797,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -82555,8 +83903,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -82644,8 +83992,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -82663,14 +84011,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -82704,7 +84056,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -82796,7 +84148,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -82810,7 +84162,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -82852,14 +84208,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -82871,7 +84227,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -83018,7 +84378,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -83087,7 +84447,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -83096,7 +84456,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -83134,8 +84494,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -83193,7 +84553,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -83465,8 +84825,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -83563,7 +84923,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -83577,7 +84937,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -83603,8 +84967,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -83619,8 +84983,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -83681,7 +85045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -83783,8 +85151,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -83872,8 +85240,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -83891,14 +85259,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -83932,7 +85304,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -84024,7 +85396,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -84038,7 +85410,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -84080,14 +85456,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -84099,7 +85475,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -84246,7 +85626,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -84315,7 +85695,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -84324,7 +85704,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -84362,8 +85742,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -84421,7 +85801,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -84693,8 +86073,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -84791,7 +86171,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -84805,7 +86185,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -84831,8 +86215,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -84847,8 +86231,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -84909,7 +86293,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -85011,8 +86399,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -85100,8 +86488,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -85119,14 +86507,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -85160,7 +86552,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -85252,7 +86644,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -85266,7 +86658,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -85308,14 +86704,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -85327,7 +86723,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -85474,7 +86874,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -85543,7 +86943,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -85552,7 +86952,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -85590,8 +86990,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -85649,7 +87049,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -85921,8 +87321,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -86019,7 +87419,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -86033,7 +87433,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -86059,8 +87463,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -86075,8 +87479,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -86137,7 +87541,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -86239,8 +87647,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -86328,8 +87736,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -86347,14 +87755,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -86388,7 +87800,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -86480,7 +87892,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -86494,7 +87906,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -86536,14 +87952,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -86555,7 +87971,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -86702,7 +88122,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -86771,7 +88191,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -86780,7 +88200,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -86818,8 +88238,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -86877,7 +88297,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -87149,8 +88569,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -87247,7 +88667,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -87261,7 +88681,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -87287,8 +88711,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -87303,8 +88727,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -87365,7 +88789,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -87467,8 +88895,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -87556,8 +88984,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -87575,14 +89003,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -87616,7 +89048,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -87708,7 +89140,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -87722,7 +89154,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -87764,14 +89200,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -87783,7 +89219,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -87930,7 +89370,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -87999,7 +89439,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -88008,7 +89448,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -88046,8 +89486,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -88105,7 +89545,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -88377,8 +89817,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -88475,7 +89915,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -88489,7 +89929,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -88515,8 +89959,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -88531,8 +89975,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -88593,7 +90037,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -88695,8 +90143,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -88784,8 +90232,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -88803,14 +90251,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -88844,7 +90296,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -88936,7 +90388,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -88950,7 +90402,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -88992,14 +90448,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -89011,7 +90467,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -89158,7 +90618,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -89227,7 +90687,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -89236,7 +90696,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -89274,8 +90734,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -89333,7 +90793,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -89605,8 +91065,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -89703,7 +91163,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -89717,7 +91177,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -89743,8 +91207,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -89759,8 +91223,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -89821,7 +91285,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -89923,8 +91391,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -90012,8 +91480,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -90031,14 +91499,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -90072,7 +91544,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -90164,7 +91636,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -90178,7 +91650,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -90220,14 +91696,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -90239,7 +91715,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -90386,7 +91866,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -90455,7 +91935,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -90464,7 +91944,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -90502,8 +91982,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -90561,7 +92041,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -90833,8 +92313,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -90931,7 +92411,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -90945,7 +92425,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -90971,8 +92455,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -90987,8 +92471,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -91049,7 +92533,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -91151,8 +92639,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -91240,8 +92728,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -91259,14 +92747,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -91300,7 +92792,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -91392,7 +92884,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -91406,7 +92898,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -91448,14 +92944,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -91467,7 +92963,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -91614,7 +93114,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -91683,7 +93183,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -91692,7 +93192,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -91730,8 +93230,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -91789,7 +93289,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -92061,8 +93561,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -92159,7 +93659,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -92173,7 +93673,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -92199,8 +93703,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -92215,8 +93719,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -92277,7 +93781,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -92379,8 +93887,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -92468,8 +93976,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -92487,14 +93995,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -92528,7 +94040,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -92620,7 +94132,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -92634,7 +94146,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -92676,14 +94192,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -92695,7 +94211,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -92842,7 +94362,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -92911,7 +94431,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -92920,7 +94440,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -92958,8 +94478,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -93017,7 +94537,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -93289,8 +94809,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -93387,7 +94907,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -93401,7 +94921,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -93427,8 +94951,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -93443,8 +94967,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -93505,7 +95029,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -93607,8 +95135,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -93696,8 +95224,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -93715,14 +95243,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -93756,7 +95288,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -93848,7 +95380,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -93862,7 +95394,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -93904,14 +95440,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -93923,7 +95459,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -94070,7 +95610,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -94139,7 +95679,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -94148,7 +95688,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -94186,8 +95726,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -94245,7 +95785,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -94517,8 +96057,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -94615,7 +96155,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -94629,7 +96169,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -94655,8 +96199,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -94671,8 +96215,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -94733,7 +96277,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -94835,8 +96383,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -94924,8 +96472,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -94943,14 +96491,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -94984,7 +96536,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -95076,7 +96628,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -95090,7 +96642,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -95132,14 +96688,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -95151,7 +96707,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -95298,7 +96858,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -95367,7 +96927,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -95376,7 +96936,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -95414,8 +96974,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -95473,7 +97033,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -95745,8 +97305,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -95843,7 +97403,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -95857,7 +97417,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -95883,8 +97447,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -95899,8 +97463,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -95961,7 +97525,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -96063,8 +97631,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -96152,8 +97720,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -96171,14 +97739,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -96212,7 +97784,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -96304,7 +97876,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -96318,7 +97890,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -96360,14 +97936,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -96379,7 +97955,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -96526,7 +98106,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -96595,7 +98175,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -96604,7 +98184,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -96642,8 +98222,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -96701,7 +98281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -96973,8 +98553,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -97071,7 +98651,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -97085,7 +98665,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -97111,8 +98695,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -97127,8 +98711,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -97189,7 +98773,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -97291,8 +98879,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -97380,8 +98968,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -97399,14 +98987,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -97440,7 +99032,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -97532,7 +99124,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -97546,7 +99138,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -97588,14 +99184,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -97607,7 +99203,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -97754,7 +99354,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -97823,7 +99423,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -97832,7 +99432,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -97870,8 +99470,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -97929,7 +99529,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -98201,8 +99801,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -98299,7 +99899,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -98313,7 +99913,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -98339,8 +99943,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -98355,8 +99959,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -98417,7 +100021,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -98519,8 +100127,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -98608,8 +100216,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -98627,14 +100235,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -98668,7 +100280,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -98760,7 +100372,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -98774,7 +100386,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -98816,14 +100432,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -98835,7 +100451,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -98982,7 +100602,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -99051,7 +100671,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -99060,7 +100680,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -99098,8 +100718,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -99157,7 +100777,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -99429,8 +101049,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -99527,7 +101147,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -99541,7 +101161,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -99567,8 +101191,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -99583,8 +101207,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -99645,7 +101269,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -99747,8 +101375,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -99836,8 +101464,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -99855,14 +101483,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -99896,7 +101528,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -99988,7 +101620,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -100002,7 +101634,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -100044,14 +101680,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -100063,7 +101699,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -100210,7 +101850,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -100279,7 +101919,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -100288,7 +101928,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -100326,8 +101966,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -100385,7 +102025,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -100657,8 +102297,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -100755,7 +102395,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -100769,7 +102409,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -100795,8 +102439,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -100811,8 +102455,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -100873,7 +102517,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -100975,8 +102623,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -101064,8 +102712,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -101083,14 +102731,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -101124,7 +102776,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -101216,7 +102868,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -101230,7 +102882,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -101272,14 +102928,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -101291,7 +102947,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -101438,7 +103098,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -101507,7 +103167,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -101516,7 +103176,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -101554,8 +103214,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -101613,7 +103273,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -101885,8 +103545,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -101983,7 +103643,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -101997,7 +103657,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -102023,8 +103687,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -102039,8 +103703,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -102101,7 +103765,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -102203,8 +103871,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -102292,8 +103960,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -102311,14 +103979,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -102352,7 +104024,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -102444,7 +104116,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -102458,7 +104130,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -102500,14 +104176,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -102519,7 +104195,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -102666,7 +104346,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -102735,7 +104415,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -102744,7 +104424,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -102782,8 +104462,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -102841,7 +104521,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -103113,8 +104793,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -103211,7 +104891,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -103225,7 +104905,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -103251,8 +104935,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -103267,8 +104951,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -103329,7 +105013,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -103431,8 +105119,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -103520,8 +105208,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -103539,14 +105227,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -103580,7 +105272,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -103672,7 +105364,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -103686,7 +105378,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -103728,14 +105424,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -103747,7 +105443,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -103894,7 +105594,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -103963,7 +105663,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -103972,7 +105672,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -104010,8 +105710,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -104069,7 +105769,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -104341,8 +106041,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -104439,7 +106139,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -104453,7 +106153,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -104479,8 +106183,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -104495,8 +106199,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -104557,7 +106261,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -104659,8 +106367,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -104748,8 +106456,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -104767,14 +106475,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -104808,7 +106520,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -104900,7 +106612,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -104914,7 +106626,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -104956,14 +106672,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -104975,7 +106691,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -105122,7 +106842,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -105191,7 +106911,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -105200,7 +106920,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -105238,8 +106958,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -105297,7 +107017,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -105569,8 +107289,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -105667,7 +107387,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -105681,7 +107401,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -105707,8 +107431,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -105723,8 +107447,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -105785,7 +107509,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -105887,8 +107615,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -105976,8 +107704,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -105995,14 +107723,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -106036,7 +107768,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -106128,7 +107860,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -106142,7 +107874,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -106184,14 +107920,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -106203,7 +107939,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -106350,7 +108090,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -106419,7 +108159,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -106428,7 +108168,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -106466,8 +108206,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -106525,7 +108265,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -106797,8 +108537,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -106895,7 +108635,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -106909,7 +108649,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -106935,8 +108679,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -106951,8 +108695,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -107013,7 +108757,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -107115,8 +108863,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -107204,8 +108952,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -107223,14 +108971,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -107264,7 +109016,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -107356,7 +109108,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -107370,7 +109122,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -107412,14 +109168,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -107431,7 +109187,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -107578,7 +109338,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -107647,7 +109407,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -107656,7 +109416,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -107694,8 +109454,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -107753,7 +109513,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -108025,8 +109785,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -108123,7 +109883,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -108137,7 +109897,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -108163,8 +109927,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -108179,8 +109943,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -108241,7 +110005,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -108343,8 +110111,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -108432,8 +110200,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -108451,14 +110219,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -108492,7 +110264,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -108584,7 +110356,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -108598,7 +110370,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -108640,14 +110416,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -108659,7 +110435,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -108806,7 +110586,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -108875,7 +110655,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -108884,7 +110664,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -108922,8 +110702,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -108981,7 +110761,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -109253,8 +111033,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -109351,7 +111131,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -109365,7 +111145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -109391,8 +111175,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -109407,8 +111191,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -109469,7 +111253,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -109571,8 +111359,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -109660,8 +111448,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -109679,14 +111467,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -109720,7 +111512,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -109812,7 +111604,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -109826,7 +111618,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -109868,14 +111664,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -109887,7 +111683,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -110034,7 +111834,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -110103,7 +111903,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -110112,7 +111912,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -110150,8 +111950,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -110209,7 +112009,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -110481,8 +112281,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -110579,7 +112379,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -110593,7 +112393,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -110619,8 +112423,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -110635,8 +112439,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -110697,7 +112501,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -110799,8 +112607,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -110888,8 +112696,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -110907,14 +112715,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -110948,7 +112760,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -111040,7 +112852,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -111054,7 +112866,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -111096,14 +112912,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -111115,7 +112931,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -111262,7 +113082,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -111331,7 +113151,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -111340,7 +113160,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -111378,8 +113198,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -111437,7 +113257,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -111709,8 +113529,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -111807,7 +113627,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -111821,7 +113641,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -111847,8 +113671,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -111863,8 +113687,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -111925,7 +113749,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -112027,8 +113855,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -112116,8 +113944,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -112135,14 +113963,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -112176,7 +114008,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -112268,7 +114100,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -112282,7 +114114,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -112324,14 +114160,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -112343,7 +114179,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -112490,7 +114330,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -112559,7 +114399,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -112568,7 +114408,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -112606,8 +114446,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -112665,7 +114505,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -112937,8 +114777,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -113035,7 +114875,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -113049,7 +114889,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -113075,8 +114919,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -113091,8 +114935,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -113153,7 +114997,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -113255,8 +115103,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -113344,8 +115192,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -113363,14 +115211,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -113404,7 +115256,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -113496,7 +115348,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -113510,7 +115362,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -113552,14 +115408,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -113571,7 +115427,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -113718,7 +115578,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -113787,7 +115647,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -113796,7 +115656,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -113834,8 +115694,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -113893,7 +115753,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -114165,8 +116025,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -114263,7 +116123,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -114277,7 +116137,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -114303,8 +116167,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -114319,8 +116183,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -114381,7 +116245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -114483,8 +116351,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -114572,8 +116440,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -114591,14 +116459,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -114632,7 +116504,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -114724,7 +116596,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -114738,7 +116610,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -114780,14 +116656,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -114799,7 +116675,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -114946,7 +116826,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -115015,7 +116895,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -115024,7 +116904,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -115062,8 +116942,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -115121,7 +117001,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -115393,8 +117273,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -115491,7 +117371,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -115505,7 +117385,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -115531,8 +117415,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -115547,8 +117431,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -115609,7 +117493,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -115711,8 +117599,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -115800,8 +117688,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -115819,14 +117707,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -115860,7 +117752,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -115952,7 +117844,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -115966,7 +117858,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -116008,14 +117904,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -116027,7 +117923,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -116174,7 +118074,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -116243,7 +118143,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -116252,7 +118152,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -116290,8 +118190,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -116349,7 +118249,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -116621,8 +118521,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -116719,7 +118619,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -116733,7 +118633,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -116759,8 +118663,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -116775,8 +118679,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -116837,7 +118741,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -116939,8 +118847,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -117028,8 +118936,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -117047,14 +118955,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -117088,7 +119000,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -117180,7 +119092,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -117194,7 +119106,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -117236,14 +119152,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -117255,7 +119171,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -117402,7 +119322,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -117471,7 +119391,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -117480,7 +119400,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -117518,8 +119438,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -117577,7 +119497,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -117849,8 +119769,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -117947,7 +119867,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -117961,7 +119881,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -117987,8 +119911,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -118003,8 +119927,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -118065,7 +119989,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -118167,8 +120095,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -118256,8 +120184,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -118275,14 +120203,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -118316,7 +120248,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -118408,7 +120340,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -118422,7 +120354,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -118464,14 +120400,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -118483,7 +120419,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -118630,7 +120570,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -118699,7 +120639,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -118708,7 +120648,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -118746,8 +120686,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -118805,7 +120745,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -119077,8 +121017,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -119175,7 +121115,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -119189,7 +121129,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -119215,8 +121159,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -119231,8 +121175,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -119293,7 +121237,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -119395,8 +121343,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -119484,8 +121432,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -119503,14 +121451,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -119544,7 +121496,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -119636,7 +121588,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -119650,7 +121602,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -119692,14 +121648,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -119711,7 +121667,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -119858,7 +121818,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -119927,7 +121887,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -119936,7 +121896,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -119974,8 +121934,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -120033,7 +121993,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -120305,8 +122265,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -120403,7 +122363,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -120417,7 +122377,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -120443,8 +122407,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -120459,8 +122423,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -120521,7 +122485,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -120623,8 +122591,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -120712,8 +122680,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -120731,14 +122699,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -120772,7 +122744,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -120864,7 +122836,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -120878,7 +122850,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -120920,14 +122896,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -120939,7 +122915,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -121086,7 +123066,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -121155,7 +123135,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -121164,7 +123144,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -121202,8 +123182,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -121261,7 +123241,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -121533,8 +123513,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -121631,7 +123611,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -121645,7 +123625,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -121671,8 +123655,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -121687,8 +123671,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -121749,7 +123733,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -121851,8 +123839,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -121940,8 +123928,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -121959,14 +123947,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -122000,7 +123992,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -122092,7 +124084,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -122106,7 +124098,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -122148,14 +124144,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -122167,7 +124163,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -122314,7 +124314,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -122383,7 +124383,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -122392,7 +124392,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -122430,8 +124430,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -122489,7 +124489,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -122761,8 +124761,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -122859,7 +124859,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -122873,7 +124873,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -122899,8 +124903,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -122915,8 +124919,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -122977,7 +124981,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -123079,8 +125087,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -123168,8 +125176,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -123187,14 +125195,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -123228,7 +125240,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -123320,7 +125332,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -123334,7 +125346,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -123376,14 +125392,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -123395,7 +125411,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -123542,7 +125562,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -123611,7 +125631,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -123620,7 +125640,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -123658,8 +125678,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -123717,7 +125737,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -123989,8 +126009,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -124087,7 +126107,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -124101,7 +126121,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -124127,8 +126151,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -124143,8 +126167,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -124205,7 +126229,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -124307,8 +126335,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -124396,8 +126424,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -124415,14 +126443,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -124456,7 +126488,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -124548,7 +126580,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -124562,7 +126594,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -124604,14 +126640,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -124623,7 +126659,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -124770,7 +126810,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -124839,7 +126879,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -124848,7 +126888,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -124886,8 +126926,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -124945,7 +126985,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -125217,8 +127257,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -125315,7 +127355,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -125329,7 +127369,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -125355,8 +127399,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -125371,8 +127415,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -125433,7 +127477,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -125535,8 +127583,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -125624,8 +127672,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -125643,14 +127691,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -125684,7 +127736,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -125776,7 +127828,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -125790,7 +127842,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -125832,14 +127888,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -125851,7 +127907,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -125998,7 +128058,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -126067,7 +128127,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -126076,7 +128136,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -126114,8 +128174,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -126173,7 +128233,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -126445,8 +128505,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -126543,7 +128603,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -126557,7 +128617,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -126583,8 +128647,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -126599,8 +128663,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -126661,7 +128725,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -126763,8 +128831,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -126852,8 +128920,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -126871,14 +128939,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -126912,7 +128984,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -127004,7 +129076,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -127018,7 +129090,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -127060,14 +129136,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -127079,7 +129155,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -127226,7 +129306,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -127295,7 +129375,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -127304,7 +129384,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -127342,8 +129422,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -127401,7 +129481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -127673,8 +129753,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -127771,7 +129851,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -127785,7 +129865,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -127811,8 +129895,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -127827,8 +129911,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -127889,7 +129973,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -127991,8 +130079,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -128080,8 +130168,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -128099,14 +130187,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -128140,7 +130232,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -128232,7 +130324,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -128246,7 +130338,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -128288,14 +130384,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -128307,7 +130403,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -128454,7 +130554,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -128523,7 +130623,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -128532,7 +130632,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -128570,8 +130670,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -128629,7 +130729,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -128901,8 +131001,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -128999,7 +131099,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -129013,7 +131113,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -129039,8 +131143,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -129055,8 +131159,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -129117,7 +131221,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -129219,8 +131327,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -129308,8 +131416,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -129327,14 +131435,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -129368,7 +131480,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -129460,7 +131572,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -129474,7 +131586,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -129516,14 +131632,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -129535,7 +131651,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -129682,7 +131802,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -129751,7 +131871,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -129760,7 +131880,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -129798,8 +131918,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -129857,7 +131977,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -130129,8 +132249,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -130227,7 +132347,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -130241,7 +132361,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -130267,8 +132391,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -130283,8 +132407,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -130345,7 +132469,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -130447,8 +132575,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -130536,8 +132664,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -130555,14 +132683,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -130596,7 +132728,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -130688,7 +132820,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -130702,7 +132834,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -130744,14 +132880,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -130763,7 +132899,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -130910,7 +133050,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -130979,7 +133119,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -130988,7 +133128,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -131026,8 +133166,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -131085,7 +133225,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -131357,8 +133497,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -131455,7 +133595,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -131469,7 +133609,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -131495,8 +133639,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -131511,8 +133655,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -131573,7 +133717,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -131675,8 +133823,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -131764,8 +133912,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -131783,14 +133931,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -131824,7 +133976,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -131916,7 +134068,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -131930,7 +134082,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -131972,14 +134128,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -131991,7 +134147,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -132138,7 +134298,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -132207,7 +134367,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -132216,7 +134376,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -132254,8 +134414,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -132313,7 +134473,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -132585,8 +134745,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -132683,7 +134843,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -132697,7 +134857,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -132723,8 +134887,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -132739,8 +134903,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -132801,7 +134965,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -132903,8 +135071,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -132992,8 +135160,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -133011,14 +135179,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -133052,7 +135224,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -133144,7 +135316,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -133158,7 +135330,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -133200,14 +135376,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -133219,7 +135395,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -133366,7 +135546,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -133435,7 +135615,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -133444,7 +135624,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -133482,8 +135662,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -133541,7 +135721,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -133813,8 +135993,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -133911,7 +136091,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -133925,7 +136105,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -133951,8 +136135,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -133967,8 +136151,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -134029,7 +136213,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -134131,8 +136319,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -134220,8 +136408,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -134239,14 +136427,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -134280,7 +136472,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -134372,7 +136564,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -134386,7 +136578,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -134428,14 +136624,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -134447,7 +136643,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -134594,7 +136794,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -134663,7 +136863,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -134672,7 +136872,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -134710,8 +136910,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -134769,7 +136969,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -135041,8 +137241,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -135139,7 +137339,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -135153,7 +137353,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -135179,8 +137383,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -135195,8 +137399,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -135257,7 +137461,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -135359,8 +137567,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -135448,8 +137656,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -135467,14 +137675,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -135508,7 +137720,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -135600,7 +137812,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -135614,7 +137826,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -135656,14 +137872,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -135675,7 +137891,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -135822,7 +138042,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -135891,7 +138111,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -135900,7 +138120,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -135938,8 +138158,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -135997,7 +138217,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -136269,8 +138489,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -136367,7 +138587,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -136381,7 +138601,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -136407,8 +138631,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -136423,8 +138647,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -136485,7 +138709,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -136587,8 +138815,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -136676,8 +138904,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -136695,14 +138923,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -136736,7 +138968,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -136828,7 +139060,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -136842,7 +139074,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -136884,14 +139120,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -136903,7 +139139,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -137050,7 +139290,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -137119,7 +139359,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -137128,7 +139368,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -137166,8 +139406,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -137225,7 +139465,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -137497,8 +139737,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -137595,7 +139835,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -137609,7 +139849,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -137635,8 +139879,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -137651,8 +139895,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -137713,7 +139957,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -137815,8 +140063,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -137904,8 +140152,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -137923,14 +140171,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -137964,7 +140216,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -138056,7 +140308,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -138070,7 +140322,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -138112,14 +140368,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -138131,7 +140387,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -138278,7 +140538,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -138347,7 +140607,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -138356,7 +140616,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -138394,8 +140654,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -138453,7 +140713,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -138725,8 +140985,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -138823,7 +141083,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -138837,7 +141097,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -138863,8 +141127,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -138879,8 +141143,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -138941,7 +141205,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -139043,8 +141311,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -139132,8 +141400,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -139151,14 +141419,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -139192,7 +141464,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -139284,7 +141556,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -139298,7 +141570,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -139340,14 +141616,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -139359,7 +141635,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -139506,7 +141786,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -139575,7 +141855,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -139584,7 +141864,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -139622,8 +141902,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -139681,7 +141961,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -139953,8 +142233,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -140051,7 +142331,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -140065,7 +142345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -140091,8 +142375,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -140107,8 +142391,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -140169,7 +142453,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -140271,8 +142559,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -140360,8 +142648,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -140379,14 +142667,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -140420,7 +142712,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -140512,7 +142804,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -140526,7 +142818,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -140568,14 +142864,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -140587,7 +142883,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -140734,7 +143034,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -140803,7 +143103,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -140812,7 +143112,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -140850,8 +143150,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -140909,7 +143209,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -141181,8 +143481,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -141279,7 +143579,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -141293,7 +143593,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -141319,8 +143623,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -141335,8 +143639,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -141397,7 +143701,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -141499,8 +143807,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -141588,8 +143896,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -141607,14 +143915,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -141648,7 +143960,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -141740,7 +144052,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -141754,7 +144066,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -141796,14 +144112,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -141815,7 +144131,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -141962,7 +144282,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -142031,7 +144351,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -142040,7 +144360,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -142078,8 +144398,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -142137,7 +144457,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -142409,8 +144729,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -142507,7 +144827,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -142521,7 +144841,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -142547,8 +144871,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -142563,8 +144887,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -142625,7 +144949,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -142727,8 +145055,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -142816,8 +145144,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -142835,14 +145163,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -142876,7 +145208,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -142968,7 +145300,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -142982,7 +145314,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -143024,14 +145360,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -143043,7 +145379,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -143190,7 +145530,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -143259,7 +145599,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -143268,7 +145608,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -143306,8 +145646,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -143365,7 +145705,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -143637,8 +145977,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -143735,7 +146075,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -143749,7 +146089,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -143775,8 +146119,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -143791,8 +146135,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -143853,7 +146197,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -143955,8 +146303,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -144044,8 +146392,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -144063,14 +146411,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -144104,7 +146456,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -144196,7 +146548,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -144210,7 +146562,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -144252,14 +146608,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -144271,7 +146627,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -144418,7 +146778,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -144487,7 +146847,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -144496,7 +146856,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -144534,8 +146894,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -144593,7 +146953,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -144865,8 +147225,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -144963,7 +147323,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -144977,7 +147337,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -145003,8 +147367,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -145019,8 +147383,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -145081,7 +147445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -145183,8 +147551,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -145272,8 +147640,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -145291,14 +147659,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -145332,7 +147704,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -145424,7 +147796,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -145438,7 +147810,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -145480,14 +147856,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -145499,7 +147875,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -145646,7 +148026,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -145715,7 +148095,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -145724,7 +148104,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -145762,8 +148142,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -145821,7 +148201,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -146093,8 +148473,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -146191,7 +148571,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -146205,7 +148585,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -146231,8 +148615,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -146247,8 +148631,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -146309,7 +148693,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -146411,8 +148799,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -146500,8 +148888,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -146519,14 +148907,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -146560,7 +148952,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -146652,7 +149044,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -146666,7 +149058,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -146708,14 +149104,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -146727,7 +149123,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -146874,7 +149274,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -146943,7 +149343,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -146952,7 +149352,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -146990,8 +149390,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -147049,7 +149449,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -147321,8 +149721,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -147419,7 +149819,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -147433,7 +149833,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -147459,8 +149863,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -147475,8 +149879,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -147537,7 +149941,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -147639,8 +150047,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -147728,8 +150136,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -147747,14 +150155,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -147788,7 +150200,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -147880,7 +150292,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -147894,7 +150306,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -147936,14 +150352,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -147955,7 +150371,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -148102,7 +150522,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -148171,7 +150591,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -148180,7 +150600,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -148218,8 +150638,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -148277,7 +150697,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -148549,8 +150969,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -148647,7 +151067,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -148661,7 +151081,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -148687,8 +151111,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -148703,8 +151127,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -148765,7 +151189,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -148867,8 +151295,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -148956,8 +151384,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -148975,14 +151403,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -149016,7 +151448,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -149108,7 +151540,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -149122,7 +151554,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -149164,14 +151600,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -149183,7 +151619,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -149330,7 +151770,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -149399,7 +151839,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -149408,7 +151848,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -149446,8 +151886,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -149505,7 +151945,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -149777,8 +152217,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -149875,7 +152315,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -149889,7 +152329,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -149915,8 +152359,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -149931,8 +152375,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -149993,7 +152437,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -150095,8 +152543,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -150184,8 +152632,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -150203,14 +152651,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -150244,7 +152696,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -150336,7 +152788,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -150350,7 +152802,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -150392,14 +152848,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -150411,7 +152867,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -150558,7 +153018,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -150627,7 +153087,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -150636,7 +153096,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -150674,8 +153134,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -150733,7 +153193,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -151005,8 +153465,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -151103,7 +153563,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -151117,7 +153577,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -151143,8 +153607,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -151159,8 +153623,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -151221,7 +153685,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -151323,8 +153791,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -151412,8 +153880,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -151431,14 +153899,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -151472,7 +153944,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -151564,7 +154036,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -151578,7 +154050,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -151620,14 +154096,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -151639,7 +154115,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -151786,7 +154266,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -151855,7 +154335,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -151864,7 +154344,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -151902,8 +154382,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -151961,7 +154441,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -152233,8 +154713,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -152331,7 +154811,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -152345,7 +154825,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -152371,8 +154855,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -152387,8 +154871,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -152449,7 +154933,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -152551,8 +155039,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -152640,8 +155128,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -152659,14 +155147,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -152700,7 +155192,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -152792,7 +155284,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -152806,7 +155298,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -152848,14 +155344,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -152867,7 +155363,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -153014,7 +155514,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -153083,7 +155583,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -153092,7 +155592,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -153130,8 +155630,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -153189,7 +155689,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -153461,8 +155961,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -153559,7 +156059,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -153573,7 +156073,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -153599,8 +156103,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -153615,8 +156119,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -153677,7 +156181,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -153779,8 +156287,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -153868,8 +156376,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -153887,14 +156395,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -153928,7 +156440,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -154020,7 +156532,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -154034,7 +156546,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -154076,14 +156592,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -154095,7 +156611,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -154242,7 +156762,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -154311,7 +156831,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -154320,7 +156840,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -154358,8 +156878,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -154417,7 +156937,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -154689,8 +157209,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -154787,7 +157307,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -154801,7 +157321,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -154827,8 +157351,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -154843,8 +157367,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -154905,7 +157429,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -155007,8 +157535,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -155096,8 +157624,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -155115,14 +157643,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -155156,7 +157688,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -155248,7 +157780,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -155262,7 +157794,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -155304,14 +157840,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -155323,7 +157859,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -155470,7 +158010,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -155539,7 +158079,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -155548,7 +158088,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -155586,8 +158126,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -155645,7 +158185,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -155917,8 +158457,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -156015,7 +158555,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -156029,7 +158569,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -156055,8 +158599,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -156071,8 +158615,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -156133,7 +158677,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -156235,8 +158783,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -156324,8 +158872,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -156343,14 +158891,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -156384,7 +158936,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -156476,7 +159028,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -156490,7 +159042,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -156532,14 +159088,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -156551,7 +159107,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -156698,7 +159258,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -156767,7 +159327,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -156776,7 +159336,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -156814,8 +159374,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -156873,7 +159433,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -157145,8 +159705,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -157243,7 +159803,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -157257,7 +159817,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -157283,8 +159847,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -157299,8 +159863,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -157361,7 +159925,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -157463,8 +160031,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -157552,8 +160120,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -157571,14 +160139,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -157612,7 +160184,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -157704,7 +160276,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -157718,7 +160290,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -157760,14 +160336,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -157779,7 +160355,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -157926,7 +160506,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -157995,7 +160575,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -158004,7 +160584,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -158042,8 +160622,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -158101,7 +160681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -158373,8 +160953,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -158471,7 +161051,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -158485,7 +161065,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -158511,8 +161095,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -158527,8 +161111,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -158589,7 +161173,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -158691,8 +161279,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -158780,8 +161368,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -158799,14 +161387,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -158840,7 +161432,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -158932,7 +161524,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -158946,7 +161538,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -158988,14 +161584,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -159007,7 +161603,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -159154,7 +161754,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -159223,7 +161823,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -159232,7 +161832,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -159270,8 +161870,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -159329,7 +161929,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -159601,8 +162201,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -159699,7 +162299,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -159713,7 +162313,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -159739,8 +162343,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -159755,8 +162359,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -159817,7 +162421,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -159919,8 +162527,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -160008,8 +162616,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -160027,14 +162635,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -160068,7 +162680,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -160160,7 +162772,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -160174,7 +162786,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -160216,14 +162832,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -160235,7 +162851,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -160382,7 +163002,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -160451,7 +163071,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -160460,7 +163080,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -160498,8 +163118,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -160557,7 +163177,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -160829,8 +163449,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -160927,7 +163547,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -160941,7 +163561,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -160967,8 +163591,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -160983,8 +163607,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -161045,7 +163669,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -161147,8 +163775,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -161236,8 +163864,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -161255,14 +163883,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -161296,7 +163928,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -161388,7 +164020,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -161402,7 +164034,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -161444,14 +164080,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -161463,7 +164099,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -161610,7 +164250,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -161679,7 +164319,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -161688,7 +164328,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -161726,8 +164366,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -161785,7 +164425,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -162057,8 +164697,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -162155,7 +164795,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -162169,7 +164809,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -162195,8 +164839,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -162211,8 +164855,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -162273,7 +164917,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -162375,8 +165023,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -162464,8 +165112,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -162483,14 +165131,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -162524,7 +165176,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -162616,7 +165268,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -162630,7 +165282,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -162672,14 +165328,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -162691,7 +165347,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -162838,7 +165498,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -162907,7 +165567,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -162916,7 +165576,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -162954,8 +165614,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -163013,7 +165673,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -163285,8 +165945,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -163383,7 +166043,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -163397,7 +166057,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -163423,8 +166087,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -163439,8 +166103,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -163501,7 +166165,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -163603,8 +166271,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -163692,8 +166360,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -163711,14 +166379,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -163752,7 +166424,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -163844,7 +166516,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -163858,7 +166530,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -163900,14 +166576,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -163919,7 +166595,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -164066,7 +166746,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -164135,7 +166815,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -164144,7 +166824,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -164182,8 +166862,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -164241,7 +166921,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -164513,8 +167193,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -164611,7 +167291,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -164625,7 +167305,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -164651,8 +167335,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -164667,8 +167351,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -164729,7 +167413,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -164831,8 +167519,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -164920,8 +167608,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -164939,14 +167627,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -164980,7 +167672,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -165072,7 +167764,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -165086,7 +167778,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -165128,14 +167824,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -165147,7 +167843,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -165294,7 +167994,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -165363,7 +168063,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -165372,7 +168072,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -165410,8 +168110,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -165469,7 +168169,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -165741,8 +168441,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -165839,7 +168539,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -165853,7 +168553,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -165879,8 +168583,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -165895,8 +168599,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -165957,7 +168661,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -166059,8 +168767,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -166148,8 +168856,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -166167,14 +168875,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -166208,7 +168920,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -166300,7 +169012,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -166314,7 +169026,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -166356,14 +169072,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -166375,7 +169091,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -166522,7 +169242,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -166591,7 +169311,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -166600,7 +169320,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -166638,8 +169358,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -166697,7 +169417,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -166969,8 +169689,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -167067,7 +169787,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -167081,7 +169801,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -167107,8 +169831,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -167123,8 +169847,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -167185,7 +169909,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -167287,8 +170015,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -167376,8 +170104,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -167395,14 +170123,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -167436,7 +170168,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -167528,7 +170260,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -167542,7 +170274,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -167584,14 +170320,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -167603,7 +170339,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -167750,7 +170490,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -167819,7 +170559,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -167828,7 +170568,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -167866,8 +170606,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -167925,7 +170665,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -168197,8 +170937,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -168295,7 +171035,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -168309,7 +171049,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -168335,8 +171079,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -168351,8 +171095,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -168413,7 +171157,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -168515,8 +171263,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -168604,8 +171352,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -168623,14 +171371,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -168664,7 +171416,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -168756,7 +171508,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -168770,7 +171522,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -168812,14 +171568,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -168831,7 +171587,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -168978,7 +171738,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -169047,7 +171807,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -169056,7 +171816,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -169094,8 +171854,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -169153,7 +171913,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -169425,8 +172185,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -169523,7 +172283,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -169537,7 +172297,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -169563,8 +172327,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -169579,8 +172343,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -169641,7 +172405,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -169743,8 +172511,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -169832,8 +172600,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -169851,14 +172619,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -169892,7 +172664,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -169984,7 +172756,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -169998,7 +172770,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -170040,14 +172816,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -170059,7 +172835,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -170206,7 +172986,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -170275,7 +173055,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -170284,7 +173064,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -170322,8 +173102,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -170381,7 +173161,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -170653,8 +173433,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -170751,7 +173531,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -170765,7 +173545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -170791,8 +173575,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -170807,8 +173591,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -170869,7 +173653,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -170971,8 +173759,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -171060,8 +173848,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -171079,14 +173867,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -171120,7 +173912,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -171212,7 +174004,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -171226,7 +174018,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -171268,14 +174064,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -171287,7 +174083,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -171434,7 +174234,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -171503,7 +174303,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -171512,7 +174312,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -171550,8 +174350,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -171609,7 +174409,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -171881,8 +174681,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -171979,7 +174779,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -171993,7 +174793,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -172019,8 +174823,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -172035,8 +174839,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -172097,7 +174901,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -172199,8 +175007,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -172288,8 +175096,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -172307,14 +175115,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -172348,7 +175160,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -172440,7 +175252,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -172454,7 +175266,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -172496,14 +175312,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -172515,7 +175331,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -172662,7 +175482,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -172731,7 +175551,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -172740,7 +175560,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -172778,8 +175598,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -172837,7 +175657,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -173109,8 +175929,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -173207,7 +176027,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -173221,7 +176041,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -173247,8 +176071,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -173263,8 +176087,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -173325,7 +176149,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -173427,8 +176255,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -173516,8 +176344,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -173535,14 +176363,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -173576,7 +176408,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -173668,7 +176500,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -173682,7 +176514,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -173724,14 +176560,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -173743,7 +176579,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -173890,7 +176730,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -173959,7 +176799,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -173968,7 +176808,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -174006,8 +176846,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -174065,7 +176905,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -174337,8 +177177,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -174435,7 +177275,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -174449,7 +177289,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -174475,8 +177319,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -174491,8 +177335,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -174553,7 +177397,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -174655,8 +177503,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -174744,8 +177592,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -174763,14 +177611,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -174804,7 +177656,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -174896,7 +177748,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -174910,7 +177762,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -174952,14 +177808,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -174971,7 +177827,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -175118,7 +177978,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -175187,7 +178047,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -175196,7 +178056,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -175234,8 +178094,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -175293,7 +178153,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -175565,8 +178425,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -175663,7 +178523,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -175677,7 +178537,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -175703,8 +178567,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -175719,8 +178583,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -175781,7 +178645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -175883,8 +178751,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -175972,8 +178840,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -175991,14 +178859,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -176032,7 +178904,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -176124,7 +178996,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -176138,7 +179010,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -176180,14 +179056,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -176199,7 +179075,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -176346,7 +179226,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -176415,7 +179295,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -176424,7 +179304,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -176462,8 +179342,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -176521,7 +179401,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -176793,8 +179673,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -176891,7 +179771,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -176905,7 +179785,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -176931,8 +179815,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -176947,8 +179831,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -177009,7 +179893,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -177111,8 +179999,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -177200,8 +180088,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -177219,14 +180107,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -177260,7 +180152,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -177352,7 +180244,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -177366,7 +180258,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -177408,14 +180304,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -177427,7 +180323,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -177574,7 +180474,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -177643,7 +180543,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -177652,7 +180552,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -177690,8 +180590,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -177749,7 +180649,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -178021,8 +180921,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -178119,7 +181019,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -178133,7 +181033,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -178159,8 +181063,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -178175,8 +181079,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -178237,7 +181141,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -178339,8 +181247,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -178428,8 +181336,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -178447,14 +181355,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -178488,7 +181400,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -178580,7 +181492,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -178594,7 +181506,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -178636,14 +181552,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -178655,7 +181571,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -178802,7 +181722,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -178871,7 +181791,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -178880,7 +181800,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -178918,8 +181838,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -178977,7 +181897,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -179249,8 +182169,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -179347,7 +182267,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -179361,7 +182281,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -179387,8 +182311,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -179403,8 +182327,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -179465,7 +182389,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -179567,8 +182495,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -179656,8 +182584,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -179675,14 +182603,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -179716,7 +182648,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -179808,7 +182740,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -179822,7 +182754,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -179864,14 +182800,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -179883,7 +182819,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -180030,7 +182970,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -180099,7 +183039,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -180108,7 +183048,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -180146,8 +183086,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -180205,7 +183145,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -180477,8 +183417,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -180575,7 +183515,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -180589,7 +183529,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -180615,8 +183559,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -180631,8 +183575,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -180693,7 +183637,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -180795,8 +183743,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -180884,8 +183832,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -180903,14 +183851,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -180944,7 +183896,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -181036,7 +183988,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -181050,7 +184002,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -181092,14 +184048,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -181111,7 +184067,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -181258,7 +184218,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -181327,7 +184287,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -181336,7 +184296,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -181374,8 +184334,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -181433,7 +184393,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -181705,8 +184665,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -181803,7 +184763,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -181817,7 +184777,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -181843,8 +184807,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -181859,8 +184823,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -181921,7 +184885,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -182023,8 +184991,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -182112,8 +185080,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -182131,14 +185099,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -182172,7 +185144,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -182264,7 +185236,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -182278,7 +185250,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -182320,14 +185296,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -182339,7 +185315,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -182486,7 +185466,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -182555,7 +185535,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -182564,7 +185544,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -182602,8 +185582,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -182661,7 +185641,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -182933,8 +185913,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -183031,7 +186011,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -183045,7 +186025,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -183071,8 +186055,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -183087,8 +186071,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -183149,7 +186133,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -183251,8 +186239,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -183340,8 +186328,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -183359,14 +186347,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -183400,7 +186392,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -183492,7 +186484,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -183506,7 +186498,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -183548,14 +186544,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -183567,7 +186563,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -183714,7 +186714,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -183783,7 +186783,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -183792,7 +186792,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -183830,8 +186830,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -183889,7 +186889,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -184161,8 +187161,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -184259,7 +187259,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -184273,7 +187273,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -184299,8 +187303,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -184315,8 +187319,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -184377,7 +187381,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -184479,8 +187487,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -184568,8 +187576,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -184587,14 +187595,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -184628,7 +187640,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -184720,7 +187732,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -184734,7 +187746,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -184776,14 +187792,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -184795,7 +187811,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -184942,7 +187962,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -185011,7 +188031,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -185020,7 +188040,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -185058,8 +188078,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -185117,7 +188137,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -185389,8 +188409,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -185487,7 +188507,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -185501,7 +188521,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -185527,8 +188551,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -185543,8 +188567,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -185605,7 +188629,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -185707,8 +188735,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -185796,8 +188824,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -185815,14 +188843,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -185856,7 +188888,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -185948,7 +188980,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -185962,7 +188994,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -186004,14 +189040,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -186023,7 +189059,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -186170,7 +189210,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -186239,7 +189279,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -186248,7 +189288,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -186286,8 +189326,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -186345,7 +189385,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -186617,8 +189657,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -186715,7 +189755,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -186729,7 +189769,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -186755,8 +189799,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -186771,8 +189815,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -186833,7 +189877,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -186935,8 +189983,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -187024,8 +190072,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -187043,14 +190091,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -187084,7 +190136,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -187176,7 +190228,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -187190,7 +190242,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -187232,14 +190288,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -187251,7 +190307,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -187398,7 +190458,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -187467,7 +190527,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -187476,7 +190536,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -187514,8 +190574,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -187573,7 +190633,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -187845,8 +190905,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -187943,7 +191003,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -187957,7 +191017,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -187983,8 +191047,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -187999,8 +191063,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -188061,7 +191125,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -188163,8 +191231,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -188252,8 +191320,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -188271,14 +191339,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -188312,7 +191384,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -188404,7 +191476,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -188418,7 +191490,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -188460,14 +191536,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -188479,7 +191555,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -188626,7 +191706,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -188695,7 +191775,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -188704,7 +191784,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -188742,8 +191822,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -188801,7 +191881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -189073,8 +192153,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -189171,7 +192251,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -189185,7 +192265,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -189211,8 +192295,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -189227,8 +192311,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -189289,7 +192373,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -189391,8 +192479,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -189480,8 +192568,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -189499,14 +192587,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -189540,7 +192632,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -189632,7 +192724,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -189646,7 +192738,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -189688,14 +192784,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -189707,7 +192803,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -189854,7 +192954,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -189923,7 +193023,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -189932,7 +193032,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -189970,8 +193070,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -190029,7 +193129,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -190301,8 +193401,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -190399,7 +193499,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -190413,7 +193513,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -190439,8 +193543,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -190455,8 +193559,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -190517,7 +193621,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -190619,8 +193727,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -190708,8 +193816,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -190727,14 +193835,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -190768,7 +193880,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -190860,7 +193972,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -190874,7 +193986,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -190916,14 +194032,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -190935,7 +194051,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -191082,7 +194202,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -191151,7 +194271,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -191160,7 +194280,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -191198,8 +194318,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -191257,7 +194377,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -191529,8 +194649,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -191627,7 +194747,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -191641,7 +194761,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -191667,8 +194791,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -191683,8 +194807,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -191745,7 +194869,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -191847,8 +194975,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -191936,8 +195064,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -191955,14 +195083,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -191996,7 +195128,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -192088,7 +195220,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -192102,7 +195234,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -192144,14 +195280,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -192163,7 +195299,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -192310,7 +195450,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -192379,7 +195519,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -192388,7 +195528,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -192426,8 +195566,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -192485,7 +195625,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -192757,8 +195897,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -192855,7 +195995,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -192869,7 +196009,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -192895,8 +196039,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -192911,8 +196055,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -192973,7 +196117,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -193075,8 +196223,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -193164,8 +196312,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -193183,14 +196331,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -193224,7 +196376,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -193316,7 +196468,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -193330,7 +196482,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -193372,14 +196528,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -193391,7 +196547,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -193538,7 +196698,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -193607,7 +196767,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -193616,7 +196776,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -193654,8 +196814,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -193713,7 +196873,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -193985,8 +197145,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -194083,7 +197243,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -194097,7 +197257,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -194123,8 +197287,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -194139,8 +197303,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -194201,7 +197365,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -194303,8 +197471,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -194392,8 +197560,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -194411,14 +197579,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -194452,7 +197624,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -194544,7 +197716,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -194558,7 +197730,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -194600,14 +197776,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -194619,7 +197795,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -194766,7 +197946,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -194835,7 +198015,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -194844,7 +198024,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -194882,8 +198062,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -194941,7 +198121,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -195213,8 +198393,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -195311,7 +198491,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -195325,7 +198505,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -195351,8 +198535,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -195367,8 +198551,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -195429,7 +198613,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -195531,8 +198719,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -195620,8 +198808,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -195639,14 +198827,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -195680,7 +198872,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -195772,7 +198964,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -195786,7 +198978,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -195828,14 +199024,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -195847,7 +199043,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -195994,7 +199194,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -196063,7 +199263,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -196072,7 +199272,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -196110,8 +199310,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -196169,7 +199369,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -196441,8 +199641,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -196539,7 +199739,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -196553,7 +199753,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -196579,8 +199783,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -196595,8 +199799,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -196657,7 +199861,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -196759,8 +199967,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -196848,8 +200056,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -196867,14 +200075,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -196908,7 +200120,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -197000,7 +200212,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -197014,7 +200226,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -197056,14 +200272,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -197075,7 +200291,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -197222,7 +200442,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -197291,7 +200511,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -197300,7 +200520,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -197338,8 +200558,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -197397,7 +200617,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -197669,8 +200889,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -197767,7 +200987,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -197781,7 +201001,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -197807,8 +201031,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -197823,8 +201047,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -197885,7 +201109,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -197987,8 +201215,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -198076,8 +201304,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -198095,14 +201323,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -198136,7 +201368,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -198228,7 +201460,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -198242,7 +201474,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -198284,14 +201520,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -198303,7 +201539,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -198450,7 +201690,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -198519,7 +201759,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -198528,7 +201768,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -198566,8 +201806,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -198625,7 +201865,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -198897,8 +202137,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -198995,7 +202235,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -199009,7 +202249,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -199035,8 +202279,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -199051,8 +202295,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -199113,7 +202357,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -199215,8 +202463,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -199304,8 +202552,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -199323,14 +202571,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -199364,7 +202616,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -199456,7 +202708,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -199470,7 +202722,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -199512,14 +202768,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -199531,7 +202787,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -199678,7 +202938,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -199747,7 +203007,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -199756,7 +203016,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -199794,8 +203054,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -199853,7 +203113,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -200125,8 +203385,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -200223,7 +203483,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -200237,7 +203497,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -200263,8 +203527,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -200279,8 +203543,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -200341,7 +203605,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -200443,8 +203711,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -200532,8 +203800,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -200551,14 +203819,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -200592,7 +203864,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -200684,7 +203956,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -200698,7 +203970,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -200740,14 +204016,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -200759,7 +204035,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -200906,7 +204186,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -200975,7 +204255,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -200984,7 +204264,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -201022,8 +204302,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -201081,7 +204361,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -201353,8 +204633,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -201451,7 +204731,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -201465,7 +204745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -201491,8 +204775,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -201507,8 +204791,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -201569,7 +204853,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -201671,8 +204959,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -201760,8 +205048,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -201779,14 +205067,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -201820,7 +205112,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -201912,7 +205204,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -201926,7 +205218,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -201968,14 +205264,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -201987,7 +205283,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -202134,7 +205434,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -202203,7 +205503,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -202212,7 +205512,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -202250,8 +205550,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -202309,7 +205609,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -202581,8 +205881,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -202679,7 +205979,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -202693,7 +205993,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -202719,8 +206023,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -202735,8 +206039,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -202797,7 +206101,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -202899,8 +206207,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -202988,8 +206296,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -203007,14 +206315,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -203048,7 +206360,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -203140,7 +206452,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -203154,7 +206466,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -203196,14 +206512,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -203215,7 +206531,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -203362,7 +206682,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -203431,7 +206751,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -203440,7 +206760,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -203478,8 +206798,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -203537,7 +206857,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -203809,8 +207129,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -203907,7 +207227,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -203921,7 +207241,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -203947,8 +207271,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -203963,8 +207287,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -204025,7 +207349,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -204127,8 +207455,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -204216,8 +207544,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -204235,14 +207563,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -204276,7 +207608,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -204368,7 +207700,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -204382,7 +207714,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -204424,14 +207760,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -204443,7 +207779,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -204590,7 +207930,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -204659,7 +207999,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -204668,7 +208008,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -204706,8 +208046,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -204765,7 +208105,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -205037,8 +208377,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -205135,7 +208475,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -205149,7 +208489,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -205175,8 +208519,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -205191,8 +208535,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -205253,7 +208597,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -205355,8 +208703,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -205444,8 +208792,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -205463,14 +208811,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -205504,7 +208856,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -205596,7 +208948,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -205610,7 +208962,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -205652,14 +209008,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -205671,7 +209027,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -205818,7 +209178,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -205887,7 +209247,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -205896,7 +209256,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -205934,8 +209294,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -205993,7 +209353,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -206265,8 +209625,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -206363,7 +209723,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -206377,7 +209737,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -206403,8 +209767,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -206419,8 +209783,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -206481,7 +209845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -206583,8 +209951,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -206672,8 +210040,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -206691,14 +210059,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -206732,7 +210104,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -206824,7 +210196,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -206838,7 +210210,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -206880,14 +210256,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -206899,7 +210275,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -207046,7 +210426,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -207115,7 +210495,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -207124,7 +210504,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -207162,8 +210542,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -207221,7 +210601,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -207493,8 +210873,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -207591,7 +210971,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -207605,7 +210985,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -207631,8 +211015,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -207647,8 +211031,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -207709,7 +211093,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -207811,8 +211199,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -207900,8 +211288,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -207919,14 +211307,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -207960,7 +211352,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -208052,7 +211444,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -208066,7 +211458,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -208108,14 +211504,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -208127,7 +211523,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -208274,7 +211674,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -208343,7 +211743,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -208352,7 +211752,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -208390,8 +211790,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -208449,7 +211849,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -208721,8 +212121,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -208819,7 +212219,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -208833,7 +212233,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -208859,8 +212263,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -208875,8 +212279,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -208937,7 +212341,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -209039,8 +212447,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -209128,8 +212536,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -209147,14 +212555,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -209188,7 +212600,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -209280,7 +212692,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -209294,7 +212706,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -209336,14 +212752,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -209355,7 +212771,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -209502,7 +212922,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -209571,7 +212991,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -209580,7 +213000,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -209618,8 +213038,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -209677,7 +213097,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -209949,8 +213369,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -210047,7 +213467,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -210061,7 +213481,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -210087,8 +213511,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -210103,8 +213527,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -210165,7 +213589,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -210267,8 +213695,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -210356,8 +213784,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -210375,14 +213803,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -210416,7 +213848,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -210508,7 +213940,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -210522,7 +213954,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -210564,14 +214000,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -210583,7 +214019,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -210730,7 +214170,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -210799,7 +214239,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -210808,7 +214248,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -210846,8 +214286,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -210905,7 +214345,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -211177,8 +214617,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -211275,7 +214715,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -211289,7 +214729,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -211315,8 +214759,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -211331,8 +214775,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -211393,7 +214837,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -211495,8 +214943,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -211584,8 +215032,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -211603,14 +215051,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -211644,7 +215096,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -211736,7 +215188,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -211750,7 +215202,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -211792,14 +215248,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -211811,7 +215267,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -211958,7 +215418,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -212027,7 +215487,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -212036,7 +215496,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -212074,8 +215534,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -212133,7 +215593,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -212405,8 +215865,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -212503,7 +215963,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -212517,7 +215977,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -212543,8 +216007,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -212559,8 +216023,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -212621,7 +216085,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -212723,8 +216191,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -212812,8 +216280,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -212831,14 +216299,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -212872,7 +216344,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -212964,7 +216436,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -212978,7 +216450,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -213020,14 +216496,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -213039,7 +216515,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -213186,7 +216666,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -213255,7 +216735,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -213264,7 +216744,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -213302,8 +216782,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -213361,7 +216841,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -213633,8 +217113,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -213731,7 +217211,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -213745,7 +217225,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -213771,8 +217255,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -213787,8 +217271,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -213849,7 +217333,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -213951,8 +217439,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -214040,8 +217528,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -214059,14 +217547,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -214100,7 +217592,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -214192,7 +217684,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -214206,7 +217698,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -214248,14 +217744,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -214267,7 +217763,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -214414,7 +217914,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -214483,7 +217983,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -214492,7 +217992,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -214530,8 +218030,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -214589,7 +218089,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -214861,8 +218361,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -214959,7 +218459,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -214973,7 +218473,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -214999,8 +218503,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -215015,8 +218519,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -215077,7 +218581,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -215179,8 +218687,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -215268,8 +218776,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -215287,14 +218795,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -215328,7 +218840,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -215420,7 +218932,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -215434,7 +218946,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -215476,14 +218992,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -215495,7 +219011,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -215642,7 +219162,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -215711,7 +219231,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -215720,7 +219240,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -215758,8 +219278,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -215817,7 +219337,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -216089,8 +219609,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -216187,7 +219707,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -216201,7 +219721,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -216227,8 +219751,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -216243,8 +219767,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -216305,7 +219829,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -216407,8 +219935,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -216496,8 +220024,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -216515,14 +220043,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -216556,7 +220088,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -216648,7 +220180,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -216662,7 +220194,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -216704,14 +220240,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -216723,7 +220259,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -216870,7 +220410,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -216939,7 +220479,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -216948,7 +220488,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -216986,8 +220526,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -217045,7 +220585,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -217317,8 +220857,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -217415,7 +220955,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -217429,7 +220969,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -217455,8 +220999,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -217471,8 +221015,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -217533,7 +221077,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -217635,8 +221183,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -217724,8 +221272,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -217743,14 +221291,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -217784,7 +221336,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -217876,7 +221428,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -217890,7 +221442,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -217932,14 +221488,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -217951,7 +221507,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -218098,7 +221658,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -218167,7 +221727,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -218176,7 +221736,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -218214,8 +221774,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -218273,7 +221833,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -218545,8 +222105,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -218643,7 +222203,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -218657,7 +222217,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -218683,8 +222247,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -218699,8 +222263,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -218761,7 +222325,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -218863,8 +222431,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -218952,8 +222520,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -218971,14 +222539,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -219012,7 +222584,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -219104,7 +222676,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -219118,7 +222690,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -219160,14 +222736,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -219179,7 +222755,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -219326,7 +222906,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -219395,7 +222975,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -219404,7 +222984,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -219442,8 +223022,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -219501,7 +223081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -219773,8 +223353,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -219871,7 +223451,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -219885,7 +223465,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -219911,8 +223495,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -219927,8 +223511,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -219989,7 +223573,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -220091,8 +223679,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -220180,8 +223768,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -220199,14 +223787,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -220240,7 +223832,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -220332,7 +223924,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -220346,7 +223938,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -220388,14 +223984,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -220407,7 +224003,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -220554,7 +224154,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -220623,7 +224223,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -220632,7 +224232,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -220670,8 +224270,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -220729,7 +224329,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -221001,8 +224601,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -221099,7 +224699,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -221113,7 +224713,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -221139,8 +224743,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -221155,8 +224759,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -221217,7 +224821,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -221319,8 +224927,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -221408,8 +225016,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -221427,14 +225035,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -221468,7 +225080,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -221560,7 +225172,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -221574,7 +225186,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -221616,14 +225232,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -221635,7 +225251,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -221782,7 +225402,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -221851,7 +225471,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -221860,7 +225480,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -221898,8 +225518,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -221957,7 +225577,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -222229,8 +225849,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -222327,7 +225947,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -222341,7 +225961,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -222367,8 +225991,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -222383,8 +226007,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -222445,7 +226069,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -222547,8 +226175,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -222636,8 +226264,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -222655,14 +226283,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -222696,7 +226328,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -222788,7 +226420,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -222802,7 +226434,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -222844,14 +226480,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -222863,7 +226499,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -223010,7 +226650,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -223079,7 +226719,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -223088,7 +226728,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -223126,8 +226766,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -223185,7 +226825,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -223457,8 +227097,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -223555,7 +227195,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -223569,7 +227209,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -223595,8 +227239,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -223611,8 +227255,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -223673,7 +227317,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -223775,8 +227423,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -223864,8 +227512,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -223883,14 +227531,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -223924,7 +227576,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -224016,7 +227668,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -224030,7 +227682,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -224072,14 +227728,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -224091,7 +227747,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -224238,7 +227898,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -224307,7 +227967,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -224316,7 +227976,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -224354,8 +228014,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -224413,7 +228073,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -224685,8 +228345,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -224783,7 +228443,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -224797,7 +228457,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -224823,8 +228487,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -224839,8 +228503,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -224901,7 +228565,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -225003,8 +228671,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -225092,8 +228760,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -225111,14 +228779,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -225152,7 +228824,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -225244,7 +228916,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -225258,7 +228930,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -225300,14 +228976,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -225319,7 +228995,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -225466,7 +229146,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -225535,7 +229215,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -225544,7 +229224,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -225582,8 +229262,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -225641,7 +229321,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -225913,8 +229593,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -226011,7 +229691,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -226025,7 +229705,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -226051,8 +229735,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -226067,8 +229751,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -226129,7 +229813,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -226231,8 +229919,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -226320,8 +230008,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -226339,14 +230027,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -226380,7 +230072,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -226472,7 +230164,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -226486,7 +230178,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -226528,14 +230224,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -226547,7 +230243,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -226694,7 +230394,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -226763,7 +230463,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -226772,7 +230472,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -226810,8 +230510,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -226869,7 +230569,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -227141,8 +230841,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -227239,7 +230939,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -227253,7 +230953,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -227279,8 +230983,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -227295,8 +230999,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -227357,7 +231061,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -227459,8 +231167,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -227548,8 +231256,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -227567,14 +231275,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -227608,7 +231320,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -227700,7 +231412,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -227714,7 +231426,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -227756,14 +231472,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -227775,7 +231491,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -227922,7 +231642,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -227991,7 +231711,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -228000,7 +231720,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -228038,8 +231758,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -228097,7 +231817,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -228369,8 +232089,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -228467,7 +232187,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -228481,7 +232201,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -228507,8 +232231,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -228523,8 +232247,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -228585,7 +232309,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -228687,8 +232415,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -228776,8 +232504,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -228795,14 +232523,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -228836,7 +232568,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -228928,7 +232660,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -228942,7 +232674,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -228984,14 +232720,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -229003,7 +232739,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -229150,7 +232890,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -229219,7 +232959,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -229228,7 +232968,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -229266,8 +233006,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -229325,7 +233065,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -229597,8 +233337,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -229695,7 +233435,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -229709,7 +233449,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -229735,8 +233479,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -229751,8 +233495,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -229813,7 +233557,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -229915,8 +233663,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -230004,8 +233752,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -230023,14 +233771,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -230064,7 +233816,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -230156,7 +233908,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -230170,7 +233922,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -230212,14 +233968,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -230231,7 +233987,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -230378,7 +234138,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -230447,7 +234207,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -230456,7 +234216,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -230494,8 +234254,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -230553,7 +234313,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -230825,8 +234585,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -230923,7 +234683,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -230937,7 +234697,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -230963,8 +234727,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -230979,8 +234743,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -231041,7 +234805,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -231143,8 +234911,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -231232,8 +235000,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -231251,14 +235019,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -231292,7 +235064,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -231384,7 +235156,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -231398,7 +235170,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -231440,14 +235216,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -231459,7 +235235,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -231606,7 +235386,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -231675,7 +235455,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -231684,7 +235464,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -231722,8 +235502,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -231781,7 +235561,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -232053,8 +235833,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -232151,7 +235931,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -232165,7 +235945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -232191,8 +235975,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -232207,8 +235991,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -232269,7 +236053,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -232371,8 +236159,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -232460,8 +236248,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -232479,14 +236267,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -232520,7 +236312,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -232612,7 +236404,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -232626,7 +236418,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -232668,14 +236464,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -232687,7 +236483,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -232834,7 +236634,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -232903,7 +236703,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -232912,7 +236712,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -232950,8 +236750,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -233009,7 +236809,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -233281,8 +237081,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -233379,7 +237179,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -233393,7 +237193,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -233419,8 +237223,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -233435,8 +237239,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -233497,7 +237301,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -233599,8 +237407,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -233688,8 +237496,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -233707,14 +237515,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -233748,7 +237560,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -233840,7 +237652,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -233854,7 +237666,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -233896,14 +237712,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -233915,7 +237731,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -234062,7 +237882,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -234131,7 +237951,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -234140,7 +237960,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -234178,8 +237998,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -234237,7 +238057,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -234509,8 +238329,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -234607,7 +238427,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -234621,7 +238441,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -234647,8 +238471,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -234663,8 +238487,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -234725,7 +238549,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -234827,8 +238655,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -234916,8 +238744,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -234935,14 +238763,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -234976,7 +238808,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -235068,7 +238900,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -235082,7 +238914,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -235124,14 +238960,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -235143,7 +238979,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -235290,7 +239130,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -235359,7 +239199,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -235368,7 +239208,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -235406,8 +239246,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -235465,7 +239305,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -235737,8 +239577,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -235835,7 +239675,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -235849,7 +239689,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -235875,8 +239719,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -235891,8 +239735,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -235953,7 +239797,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -236055,8 +239903,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -236144,8 +239992,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -236163,14 +240011,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -236204,7 +240056,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -236296,7 +240148,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -236310,7 +240162,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -236352,14 +240208,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -236371,7 +240227,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -236518,7 +240378,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -236587,7 +240447,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -236596,7 +240456,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -236634,8 +240494,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -236693,7 +240553,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -236965,8 +240825,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -237063,7 +240923,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -237077,7 +240937,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -237103,8 +240967,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -237119,8 +240983,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -237181,7 +241045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -237283,8 +241151,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -237372,8 +241240,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -237391,14 +241259,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -237432,7 +241304,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -237524,7 +241396,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -237538,7 +241410,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -237580,14 +241456,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -237599,7 +241475,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -237746,7 +241626,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -237815,7 +241695,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -237824,7 +241704,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -237862,8 +241742,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -237921,7 +241801,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -238193,8 +242073,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -238291,7 +242171,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -238305,7 +242185,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -238331,8 +242215,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -238347,8 +242231,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -238409,7 +242293,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -238511,8 +242399,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -238600,8 +242488,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -238619,14 +242507,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -238660,7 +242552,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -238752,7 +242644,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -238766,7 +242658,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -238808,14 +242704,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -238827,7 +242723,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -238974,7 +242874,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -239043,7 +242943,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -239052,7 +242952,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -239090,8 +242990,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -239149,7 +243049,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -239421,8 +243321,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -239519,7 +243419,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -239533,7 +243433,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -239559,8 +243463,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -239575,8 +243479,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -239637,7 +243541,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -239739,8 +243647,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -239828,8 +243736,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -239847,14 +243755,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -239888,7 +243800,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -239980,7 +243892,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -239994,7 +243906,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -240036,14 +243952,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -240055,7 +243971,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -240202,7 +244122,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -240271,7 +244191,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -240280,7 +244200,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -240318,8 +244238,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -240377,7 +244297,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -240649,8 +244569,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -240747,7 +244667,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -240761,7 +244681,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -240787,8 +244711,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -240803,8 +244727,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -240865,7 +244789,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -240967,8 +244895,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -241056,8 +244984,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -241075,14 +245003,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -241116,7 +245048,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -241208,7 +245140,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -241222,7 +245154,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -241264,14 +245200,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -241283,7 +245219,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -241430,7 +245370,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -241499,7 +245439,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -241508,7 +245448,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -241546,8 +245486,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -241605,7 +245545,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -241877,8 +245817,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -241975,7 +245915,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -241989,7 +245929,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -242015,8 +245959,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -242031,8 +245975,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -242093,7 +246037,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -242195,8 +246143,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -242284,8 +246232,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -242303,14 +246251,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -242344,7 +246296,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -242436,7 +246388,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -242450,7 +246402,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -242492,14 +246448,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -242511,7 +246467,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -242658,7 +246618,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -242727,7 +246687,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -242736,7 +246696,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -242774,8 +246734,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -242833,7 +246793,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -243105,8 +247065,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -243203,7 +247163,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -243217,7 +247177,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -243243,8 +247207,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -243259,8 +247223,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -243321,7 +247285,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -243423,8 +247391,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -243512,8 +247480,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -243531,14 +247499,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -243572,7 +247544,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -243664,7 +247636,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -243678,7 +247650,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -243720,14 +247696,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -243739,7 +247715,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -243886,7 +247866,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -243955,7 +247935,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -243964,7 +247944,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -244002,8 +247982,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -244061,7 +248041,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -244333,8 +248313,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -244431,7 +248411,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -244445,7 +248425,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -244471,8 +248455,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -244487,8 +248471,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -244549,7 +248533,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -244651,8 +248639,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -244740,8 +248728,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -244759,14 +248747,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -244800,7 +248792,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -244892,7 +248884,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -244906,7 +248898,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -244948,14 +248944,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -244967,7 +248963,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -245114,7 +249114,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -245183,7 +249183,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -245192,7 +249192,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -245230,8 +249230,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -245289,7 +249289,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -245561,8 +249561,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -245659,7 +249659,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -245673,7 +249673,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -245699,8 +249703,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -245715,8 +249719,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -245777,7 +249781,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -245879,8 +249887,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -245968,8 +249976,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -245987,14 +249995,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -246028,7 +250040,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -246120,7 +250132,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -246134,7 +250146,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -246176,14 +250192,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -246195,7 +250211,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -246342,7 +250362,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -246411,7 +250431,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -246420,7 +250440,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -246458,8 +250478,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -246517,7 +250537,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -246789,8 +250809,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -246887,7 +250907,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -246901,7 +250921,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -246927,8 +250951,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -246943,8 +250967,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -247005,7 +251029,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -247107,8 +251135,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -247196,8 +251224,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -247215,14 +251243,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -247256,7 +251288,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -247348,7 +251380,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -247362,7 +251394,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -247404,14 +251440,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -247423,7 +251459,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -247570,7 +251610,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -247639,7 +251679,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -247648,7 +251688,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -247686,8 +251726,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -247745,7 +251785,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -248017,8 +252057,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -248115,7 +252155,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -248129,7 +252169,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -248155,8 +252199,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -248171,8 +252215,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -248233,7 +252277,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -248335,8 +252383,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -248424,8 +252472,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -248443,14 +252491,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -248484,7 +252536,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -248576,7 +252628,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -248590,7 +252642,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -248632,14 +252688,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -248651,7 +252707,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -248798,7 +252858,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -248867,7 +252927,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -248876,7 +252936,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -248914,8 +252974,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -248973,7 +253033,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -249245,8 +253305,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -249343,7 +253403,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -249357,7 +253417,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -249383,8 +253447,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -249399,8 +253463,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -249461,7 +253525,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -249563,8 +253631,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -249652,8 +253720,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -249671,14 +253739,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -249712,7 +253784,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -249804,7 +253876,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -249818,7 +253890,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -249860,14 +253936,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -249879,7 +253955,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -250026,7 +254106,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -250095,7 +254175,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -250104,7 +254184,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -250142,8 +254222,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -250201,7 +254281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -250473,8 +254553,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -250571,7 +254651,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -250585,7 +254665,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -250611,8 +254695,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -250627,8 +254711,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -250689,7 +254773,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -250791,8 +254879,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -250880,8 +254968,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -250899,14 +254987,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -250940,7 +255032,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -251032,7 +255124,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -251046,7 +255138,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -251088,14 +255184,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -251107,7 +255203,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -251254,7 +255354,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -251323,7 +255423,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -251332,7 +255432,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -251370,8 +255470,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -251429,7 +255529,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -251701,8 +255801,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -251799,7 +255899,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -251813,7 +255913,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -251839,8 +255943,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -251855,8 +255959,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -251917,7 +256021,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -252019,8 +256127,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -252108,8 +256216,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -252127,14 +256235,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -252168,7 +256280,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -252260,7 +256372,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -252274,7 +256386,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -252316,14 +256432,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -252335,7 +256451,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -252482,7 +256602,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -252551,7 +256671,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -252560,7 +256680,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -252598,8 +256718,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -252657,7 +256777,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -252929,8 +257049,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -253027,7 +257147,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -253041,7 +257161,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -253067,8 +257191,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -253083,8 +257207,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -253145,7 +257269,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -253247,8 +257375,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -253336,8 +257464,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -253355,14 +257483,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -253396,7 +257528,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -253488,7 +257620,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -253502,7 +257634,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -253544,14 +257680,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -253563,7 +257699,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -253710,7 +257850,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -253779,7 +257919,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -253788,7 +257928,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -253826,8 +257966,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -253885,7 +258025,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -254157,8 +258297,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -254255,7 +258395,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -254269,7 +258409,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -254295,8 +258439,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -254311,8 +258455,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -254373,7 +258517,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -254475,8 +258623,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -254564,8 +258712,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -254583,14 +258731,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -254624,7 +258776,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -254716,7 +258868,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -254730,7 +258882,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -254772,14 +258928,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -254791,7 +258947,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -254938,7 +259098,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -255007,7 +259167,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -255016,7 +259176,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -255054,8 +259214,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -255113,7 +259273,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -255385,8 +259545,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -255483,7 +259643,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -255497,7 +259657,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -255523,8 +259687,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -255539,8 +259703,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -255601,7 +259765,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -255703,8 +259871,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -255792,8 +259960,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -255811,14 +259979,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -255852,7 +260024,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -255944,7 +260116,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -255958,7 +260130,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -256000,14 +260176,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -256019,7 +260195,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -256166,7 +260346,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -256235,7 +260415,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -256244,7 +260424,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -256282,8 +260462,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -256341,7 +260521,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -256613,8 +260793,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -256711,7 +260891,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -256725,7 +260905,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -256751,8 +260935,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -256767,8 +260951,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -256829,7 +261013,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -256931,8 +261119,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -257020,8 +261208,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -257039,14 +261227,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -257080,7 +261272,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -257172,7 +261364,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -257186,7 +261378,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -257228,14 +261424,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -257247,7 +261443,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -257394,7 +261594,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -257463,7 +261663,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -257472,7 +261672,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -257510,8 +261710,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -257569,7 +261769,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -257841,8 +262041,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -257939,7 +262139,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -257953,7 +262153,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -257979,8 +262183,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -257995,8 +262199,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -258057,7 +262261,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -258159,8 +262367,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -258248,8 +262456,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -258267,14 +262475,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -258308,7 +262520,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -258400,7 +262612,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -258414,7 +262626,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -258456,14 +262672,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -258475,7 +262691,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -258622,7 +262842,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -258691,7 +262911,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -258700,7 +262920,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -258738,8 +262958,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -258797,7 +263017,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -259069,8 +263289,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -259167,7 +263387,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -259181,7 +263401,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -259207,8 +263431,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -259223,8 +263447,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -259285,7 +263509,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -259387,8 +263615,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -259476,8 +263704,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -259495,14 +263723,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -259536,7 +263768,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -259628,7 +263860,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -259642,7 +263874,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -259684,14 +263920,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -259703,7 +263939,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -259850,7 +264090,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -259919,7 +264159,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -259928,7 +264168,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -259966,8 +264206,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -260025,7 +264265,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -260297,8 +264537,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -260395,7 +264635,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -260409,7 +264649,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -260435,8 +264679,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -260451,8 +264695,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -260513,7 +264757,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -260615,8 +264863,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -260704,8 +264952,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -260723,14 +264971,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -260764,7 +265016,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -260856,7 +265108,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -260870,7 +265122,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -260912,14 +265168,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -260931,7 +265187,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -261078,7 +265338,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -261147,7 +265407,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -261156,7 +265416,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -261194,8 +265454,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -261253,7 +265513,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -261525,8 +265785,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -261623,7 +265883,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -261637,7 +265897,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -261663,8 +265927,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -261679,8 +265943,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -261741,7 +266005,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -261843,8 +266111,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -261932,8 +266200,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -261951,14 +266219,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -261992,7 +266264,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -262084,7 +266356,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -262098,7 +266370,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -262140,14 +266416,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -262159,7 +266435,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -262306,7 +266586,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -262375,7 +266655,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -262384,7 +266664,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -262422,8 +266702,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -262481,7 +266761,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -262753,8 +267033,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -262851,7 +267131,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -262865,7 +267145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -262891,8 +267175,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -262907,8 +267191,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -262969,7 +267253,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -263071,8 +267359,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -263160,8 +267448,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -263179,14 +267467,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -263220,7 +267512,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -263312,7 +267604,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -263326,7 +267618,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -263368,14 +267664,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -263387,7 +267683,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -263534,7 +267834,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -263603,7 +267903,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -263612,7 +267912,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -263650,8 +267950,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -263709,7 +268009,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -263981,8 +268281,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -264079,7 +268379,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -264093,7 +268393,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -264119,8 +268423,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -264135,8 +268439,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -264197,7 +268501,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -264299,8 +268607,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -264388,8 +268696,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -264407,14 +268715,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -264448,7 +268760,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -264540,7 +268852,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -264554,7 +268866,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -264596,14 +268912,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -264615,7 +268931,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -264762,7 +269082,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -264831,7 +269151,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -264840,7 +269160,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -264878,8 +269198,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -264937,7 +269257,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -265209,8 +269529,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -265307,7 +269627,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -265321,7 +269641,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -265347,8 +269671,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -265363,8 +269687,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -265425,7 +269749,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -265527,8 +269855,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -265616,8 +269944,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -265635,14 +269963,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -265676,7 +270008,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -265768,7 +270100,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -265782,7 +270114,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -265824,14 +270160,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -265843,7 +270179,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -265990,7 +270330,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -266059,7 +270399,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -266068,7 +270408,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -266106,8 +270446,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -266165,7 +270505,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -266437,8 +270777,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -266535,7 +270875,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -266549,7 +270889,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -266575,8 +270919,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -266591,8 +270935,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -266653,7 +270997,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -266755,8 +271103,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -266844,8 +271192,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -266863,14 +271211,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -266904,7 +271256,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -266996,7 +271348,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -267010,7 +271362,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -267052,14 +271408,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -267071,7 +271427,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -267218,7 +271578,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -267287,7 +271647,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -267296,7 +271656,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -267334,8 +271694,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -267393,7 +271753,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -267665,8 +272025,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -267763,7 +272123,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -267777,7 +272137,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -267803,8 +272167,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -267819,8 +272183,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -267881,7 +272245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -267983,8 +272351,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -268072,8 +272440,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -268091,14 +272459,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -268132,7 +272504,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -268224,7 +272596,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -268238,7 +272610,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -268280,14 +272656,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -268299,7 +272675,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -268446,7 +272826,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -268515,7 +272895,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -268524,7 +272904,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -268562,8 +272942,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -268621,7 +273001,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -268893,8 +273273,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -268991,7 +273371,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -269005,7 +273385,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -269031,8 +273415,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -269047,8 +273431,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -269109,7 +273493,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -269211,8 +273599,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -269300,8 +273688,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -269319,14 +273707,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -269360,7 +273752,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -269452,7 +273844,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -269466,7 +273858,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -269508,14 +273904,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -269527,7 +273923,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -269674,7 +274074,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -269743,7 +274143,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -269752,7 +274152,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -269790,8 +274190,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -269849,7 +274249,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -270121,8 +274521,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -270219,7 +274619,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -270233,7 +274633,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -270259,8 +274663,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -270275,8 +274679,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -270337,7 +274741,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -270439,8 +274847,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -270528,8 +274936,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -270547,14 +274955,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -270588,7 +275000,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -270680,7 +275092,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -270694,7 +275106,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -270736,14 +275152,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -270755,7 +275171,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -270902,7 +275322,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -270971,7 +275391,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -270980,7 +275400,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -271018,8 +275438,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -271077,7 +275497,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -271349,8 +275769,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -271447,7 +275867,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -271461,7 +275881,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -271487,8 +275911,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -271503,8 +275927,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -271565,7 +275989,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -271667,8 +276095,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -271756,8 +276184,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -271775,14 +276203,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -271816,7 +276248,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -271908,7 +276340,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -271922,7 +276354,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -271964,14 +276400,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -271983,7 +276419,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -272130,7 +276570,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -272199,7 +276639,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -272208,7 +276648,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -272246,8 +276686,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -272305,7 +276745,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -272577,8 +277017,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -272675,7 +277115,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -272689,7 +277129,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -272715,8 +277159,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -272731,8 +277175,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -272793,7 +277237,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -272895,8 +277343,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -272984,8 +277432,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -273003,14 +277451,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -273044,7 +277496,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -273136,7 +277588,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -273150,7 +277602,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -273192,14 +277648,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -273211,7 +277667,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -273358,7 +277818,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -273427,7 +277887,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -273436,7 +277896,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -273474,8 +277934,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -273533,7 +277993,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -273805,8 +278265,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -273903,7 +278363,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -273917,7 +278377,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -273943,8 +278407,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -273959,8 +278423,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -274021,7 +278485,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -274123,8 +278591,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -274212,8 +278680,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -274231,14 +278699,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -274272,7 +278744,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -274364,7 +278836,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -274378,7 +278850,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -274420,14 +278896,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -274439,7 +278915,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -274586,7 +279066,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -274655,7 +279135,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -274664,7 +279144,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -274702,8 +279182,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -274761,7 +279241,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -275033,8 +279513,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -275131,7 +279611,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -275145,7 +279625,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -275171,8 +279655,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -275187,8 +279671,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -275249,7 +279733,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -275351,8 +279839,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -275440,8 +279928,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -275459,14 +279947,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -275500,7 +279992,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -275592,7 +280084,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -275606,7 +280098,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -275648,14 +280144,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -275667,7 +280163,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -275814,7 +280314,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -275883,7 +280383,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -275892,7 +280392,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -275930,8 +280430,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -275989,7 +280489,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -276261,8 +280761,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -276359,7 +280859,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -276373,7 +280873,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -276399,8 +280903,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -276415,8 +280919,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -276477,7 +280981,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -276579,8 +281087,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -276668,8 +281176,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -276687,14 +281195,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -276728,7 +281240,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -276820,7 +281332,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -276834,7 +281346,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -276876,14 +281392,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -276895,7 +281411,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -277042,7 +281562,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -277111,7 +281631,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -277120,7 +281640,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -277158,8 +281678,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -277217,7 +281737,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -277489,8 +282009,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -277587,7 +282107,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -277601,7 +282121,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -277627,8 +282151,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -277643,8 +282167,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -277705,7 +282229,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -277807,8 +282335,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -277896,8 +282424,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -277915,14 +282443,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -277956,7 +282488,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -278048,7 +282580,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -278062,7 +282594,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -278104,14 +282640,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -278123,7 +282659,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -278270,7 +282810,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -278339,7 +282879,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -278348,7 +282888,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -278386,8 +282926,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -278445,7 +282985,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -278717,8 +283257,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -278815,7 +283355,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -278829,7 +283369,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -278855,8 +283399,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -278871,8 +283415,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -278933,7 +283477,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -279035,8 +283583,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -279124,8 +283672,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -279143,14 +283691,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -279184,7 +283736,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -279276,7 +283828,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -279290,7 +283842,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -279332,14 +283888,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -279351,7 +283907,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -279498,7 +284058,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -279567,7 +284127,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -279576,7 +284136,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -279614,8 +284174,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -279673,7 +284233,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -279945,8 +284505,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -280043,7 +284603,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -280057,7 +284617,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -280083,8 +284647,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -280099,8 +284663,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -280161,7 +284725,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -280263,8 +284831,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -280352,8 +284920,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -280371,14 +284939,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -280412,7 +284984,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -280504,7 +285076,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -280518,7 +285090,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -280560,14 +285136,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -280579,7 +285155,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -280726,7 +285306,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -280795,7 +285375,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -280804,7 +285384,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -280842,8 +285422,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -280901,7 +285481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -281173,8 +285753,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -281271,7 +285851,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -281285,7 +285865,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -281311,8 +285895,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -281327,8 +285911,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -281389,7 +285973,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -281491,8 +286079,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -281580,8 +286168,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -281599,14 +286187,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -281640,7 +286232,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -281732,7 +286324,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -281746,7 +286338,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -281788,14 +286384,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -281807,7 +286403,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -281954,7 +286554,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -282023,7 +286623,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -282032,7 +286632,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -282070,8 +286670,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -282129,7 +286729,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -282401,8 +287001,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -282499,7 +287099,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -282513,7 +287113,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -282539,8 +287143,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -282555,8 +287159,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -282617,7 +287221,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -282719,8 +287327,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -282808,8 +287416,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -282827,14 +287435,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -282868,7 +287480,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -282960,7 +287572,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -282974,7 +287586,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -283016,14 +287632,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -283035,7 +287651,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -283182,7 +287802,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -283251,7 +287871,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -283260,7 +287880,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -283298,8 +287918,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -283357,7 +287977,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -283629,8 +288249,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -283727,7 +288347,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -283741,7 +288361,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -283767,8 +288391,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -283783,8 +288407,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -283845,7 +288469,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -283947,8 +288575,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -284036,8 +288664,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -284055,14 +288683,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -284096,7 +288728,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -284188,7 +288820,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -284202,7 +288834,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -284244,14 +288880,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -284263,7 +288899,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -284410,7 +289050,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -284479,7 +289119,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -284488,7 +289128,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -284526,8 +289166,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -284585,7 +289225,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -284857,8 +289497,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -284955,7 +289595,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -284969,7 +289609,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -284995,8 +289639,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -285011,8 +289655,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -285073,7 +289717,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -285175,8 +289823,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -285264,8 +289912,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -285283,14 +289931,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -285324,7 +289976,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -285416,7 +290068,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -285430,7 +290082,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -285472,14 +290128,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -285491,7 +290147,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -285638,7 +290298,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -285707,7 +290367,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -285716,7 +290376,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -285754,8 +290414,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -285813,7 +290473,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -286085,8 +290745,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -286183,7 +290843,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -286197,7 +290857,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -286223,8 +290887,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -286239,8 +290903,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -286301,7 +290965,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -286403,8 +291071,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -286492,8 +291160,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -286511,14 +291179,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -286552,7 +291224,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -286644,7 +291316,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -286658,7 +291330,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -286700,14 +291376,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -286719,7 +291395,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -286866,7 +291546,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -286935,7 +291615,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -286944,7 +291624,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -286982,8 +291662,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -287041,7 +291721,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -287313,8 +291993,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -287411,7 +292091,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -287425,7 +292105,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -287451,8 +292135,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -287467,8 +292151,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -287529,7 +292213,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -287631,8 +292319,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -287720,8 +292408,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -287739,14 +292427,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -287780,7 +292472,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -287872,7 +292564,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -287886,7 +292578,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -287928,14 +292624,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -287947,7 +292643,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -288094,7 +292794,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -288163,7 +292863,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -288172,7 +292872,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -288210,8 +292910,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -288269,7 +292969,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -288541,8 +293241,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -288639,7 +293339,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -288653,7 +293353,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -288679,8 +293383,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -288695,8 +293399,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -288757,7 +293461,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -288859,8 +293567,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -288948,8 +293656,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -288967,14 +293675,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -289008,7 +293720,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -289100,7 +293812,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -289114,7 +293826,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -289156,14 +293872,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -289175,7 +293891,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -289322,7 +294042,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -289391,7 +294111,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -289400,7 +294120,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -289438,8 +294158,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -289497,7 +294217,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -289769,8 +294489,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -289867,7 +294587,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -289881,7 +294601,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -289907,8 +294631,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -289923,8 +294647,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -289985,7 +294709,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -290087,8 +294815,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -290176,8 +294904,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -290195,14 +294923,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -290236,7 +294968,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -290328,7 +295060,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -290342,7 +295074,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -290384,14 +295120,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -290403,7 +295139,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -290550,7 +295290,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -290619,7 +295359,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -290628,7 +295368,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -290666,8 +295406,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -290725,7 +295465,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -290997,8 +295737,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -291095,7 +295835,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -291109,7 +295849,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -291135,8 +295879,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -291151,8 +295895,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -291213,7 +295957,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -291315,8 +296063,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -291404,8 +296152,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -291423,14 +296171,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -291464,7 +296216,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -291556,7 +296308,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -291570,7 +296322,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -291612,14 +296368,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -291631,7 +296387,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -291778,7 +296538,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -291847,7 +296607,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -291856,7 +296616,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -291894,8 +296654,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -291953,7 +296713,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -292225,8 +296985,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -292323,7 +297083,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -292337,7 +297097,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -292363,8 +297127,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -292379,8 +297143,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -292441,7 +297205,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -292543,8 +297311,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -292632,8 +297400,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -292651,14 +297419,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -292692,7 +297464,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -292784,7 +297556,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -292798,7 +297570,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -292840,14 +297616,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -292859,7 +297635,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -293006,7 +297786,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -293075,7 +297855,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -293084,7 +297864,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -293122,8 +297902,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -293181,7 +297961,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -293453,8 +298233,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -293551,7 +298331,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -293565,7 +298345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -293591,8 +298375,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -293607,8 +298391,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -293669,7 +298453,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -293771,8 +298559,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -293860,8 +298648,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -293879,14 +298667,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -293920,7 +298712,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -294012,7 +298804,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -294026,7 +298818,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -294068,14 +298864,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -294087,7 +298883,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -294234,7 +299034,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -294303,7 +299103,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -294312,7 +299112,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -294350,8 +299150,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -294409,7 +299209,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -294681,8 +299481,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -294779,7 +299579,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -294793,7 +299593,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -294819,8 +299623,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -294835,8 +299639,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -294897,7 +299701,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -294999,8 +299807,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -295088,8 +299896,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -295107,14 +299915,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -295148,7 +299960,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -295240,7 +300052,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -295254,7 +300066,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -295296,14 +300112,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -295315,7 +300131,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -295462,7 +300282,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -295531,7 +300351,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -295540,7 +300360,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -295578,8 +300398,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -295637,7 +300457,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -295909,8 +300729,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -296007,7 +300827,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -296021,7 +300841,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -296047,8 +300871,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -296063,8 +300887,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -296125,7 +300949,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -296227,8 +301055,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -296316,8 +301144,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -296335,14 +301163,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -296376,7 +301208,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -296468,7 +301300,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -296482,7 +301314,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -296524,14 +301360,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -296543,7 +301379,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -296690,7 +301530,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -296759,7 +301599,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -296768,7 +301608,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -296806,8 +301646,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -296865,7 +301705,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -297137,8 +301977,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -297235,7 +302075,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -297249,7 +302089,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -297275,8 +302119,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -297291,8 +302135,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -297353,7 +302197,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -297455,8 +302303,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -297544,8 +302392,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -297563,14 +302411,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -297604,7 +302456,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -297696,7 +302548,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -297710,7 +302562,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -297752,14 +302608,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -297771,7 +302627,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -297918,7 +302778,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -297987,7 +302847,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -297996,7 +302856,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -298034,8 +302894,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -298093,7 +302953,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -298365,8 +303225,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -298463,7 +303323,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -298477,7 +303337,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -298503,8 +303367,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -298519,8 +303383,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -298581,7 +303445,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -298683,8 +303551,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -298772,8 +303640,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -298791,14 +303659,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -298832,7 +303704,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -298924,7 +303796,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -298938,7 +303810,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -298980,14 +303856,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -298999,7 +303875,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -299146,7 +304026,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -299215,7 +304095,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -299224,7 +304104,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -299262,8 +304142,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -299321,7 +304201,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -299593,8 +304473,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -299691,7 +304571,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -299705,7 +304585,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -299731,8 +304615,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -299747,8 +304631,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -299809,7 +304693,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -299911,8 +304799,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -300000,8 +304888,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -300019,14 +304907,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -300060,7 +304952,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -300152,7 +305044,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -300166,7 +305058,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -300208,14 +305104,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -300227,7 +305123,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -300374,7 +305274,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -300443,7 +305343,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -300452,7 +305352,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -300490,8 +305390,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -300549,7 +305449,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -300821,8 +305721,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -300919,7 +305819,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -300933,7 +305833,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -300959,8 +305863,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -300975,8 +305879,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -301037,7 +305941,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -301139,8 +306047,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -301228,8 +306136,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -301247,14 +306155,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -301288,7 +306200,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -301380,7 +306292,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -301394,7 +306306,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -301436,14 +306352,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -301455,7 +306371,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -301602,7 +306522,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -301671,7 +306591,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -301680,7 +306600,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -301718,8 +306638,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -301777,7 +306697,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -302049,8 +306969,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -302147,7 +307067,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -302161,7 +307081,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -302187,8 +307111,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -302203,8 +307127,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -302265,7 +307189,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -302367,8 +307295,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -302456,8 +307384,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -302475,14 +307403,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -302516,7 +307448,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -302608,7 +307540,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -302622,7 +307554,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -302664,14 +307600,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -302683,7 +307619,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -302830,7 +307770,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -302899,7 +307839,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -302908,7 +307848,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -302946,8 +307886,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -303005,7 +307945,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -303277,8 +308217,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -303375,7 +308315,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -303389,7 +308329,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -303415,8 +308359,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -303431,8 +308375,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -303493,7 +308437,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -303595,8 +308543,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -303684,8 +308632,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -303703,14 +308651,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -303744,7 +308696,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -303836,7 +308788,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -303850,7 +308802,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -303892,14 +308848,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -303911,7 +308867,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -304058,7 +309018,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -304127,7 +309087,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -304136,7 +309096,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -304174,8 +309134,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -304233,7 +309193,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -304505,8 +309465,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -304603,7 +309563,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -304617,7 +309577,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -304643,8 +309607,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -304659,8 +309623,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -304721,7 +309685,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -304823,8 +309791,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -304912,8 +309880,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -304931,14 +309899,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -304972,7 +309944,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -305064,7 +310036,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -305078,7 +310050,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -305120,14 +310096,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -305139,7 +310115,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -305286,7 +310266,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -305355,7 +310335,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -305364,7 +310344,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -305402,8 +310382,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -305461,7 +310441,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -305733,8 +310713,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -305831,7 +310811,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -305845,7 +310825,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -305871,8 +310855,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -305887,8 +310871,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -305949,7 +310933,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -306051,8 +311039,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -306140,8 +311128,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -306159,14 +311147,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -306200,7 +311192,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -306292,7 +311284,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -306306,7 +311298,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -306348,14 +311344,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -306367,7 +311363,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -306514,7 +311514,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -306583,7 +311583,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -306592,7 +311592,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -306630,8 +311630,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -306689,7 +311689,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -306961,8 +311961,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -307059,7 +312059,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -307073,7 +312073,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -307099,8 +312103,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -307115,8 +312119,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -307177,7 +312181,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -307279,8 +312287,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -307368,8 +312376,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -307387,14 +312395,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -307428,7 +312440,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -307520,7 +312532,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -307534,7 +312546,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -307576,14 +312592,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -307595,7 +312611,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -307742,7 +312762,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -307811,7 +312831,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -307820,7 +312840,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -307858,8 +312878,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -307917,7 +312937,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -308189,8 +313209,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -308287,7 +313307,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -308301,7 +313321,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -308327,8 +313351,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -308343,8 +313367,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -308405,7 +313429,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -308507,8 +313535,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -308596,8 +313624,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -308615,14 +313643,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -308656,7 +313688,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -308748,7 +313780,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -308762,7 +313794,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -308804,14 +313840,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -308823,7 +313859,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -308970,7 +314010,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -309039,7 +314079,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -309048,7 +314088,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -309086,8 +314126,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -309145,7 +314185,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -309417,8 +314457,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -309515,7 +314555,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -309529,7 +314569,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -309555,8 +314599,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -309571,8 +314615,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -309633,7 +314677,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -309735,8 +314783,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -309824,8 +314872,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -309843,14 +314891,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -309884,7 +314936,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -309976,7 +315028,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -309990,7 +315042,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -310032,14 +315088,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -310051,7 +315107,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -310198,7 +315258,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -310267,7 +315327,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -310276,7 +315336,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -310314,8 +315374,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -310373,7 +315433,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -310645,8 +315705,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -310743,7 +315803,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -310757,7 +315817,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -310783,8 +315847,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -310799,8 +315863,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -310861,7 +315925,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -310963,8 +316031,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -311052,8 +316120,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -311071,14 +316139,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -311112,7 +316184,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -311204,7 +316276,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -311218,7 +316290,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -311260,14 +316336,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -311279,7 +316355,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -311426,7 +316506,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -311495,7 +316575,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -311504,7 +316584,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -311542,8 +316622,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -311601,7 +316681,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -311873,8 +316953,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -311971,7 +317051,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -311985,7 +317065,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -312011,8 +317095,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -312027,8 +317111,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -312089,7 +317173,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -312191,8 +317279,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -312280,8 +317368,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -312299,14 +317387,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -312340,7 +317432,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -312432,7 +317524,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -312446,7 +317538,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -312488,14 +317584,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -312507,7 +317603,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -312654,7 +317754,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -312723,7 +317823,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -312732,7 +317832,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -312770,8 +317870,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -312829,7 +317929,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -313101,8 +318201,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -313199,7 +318299,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -313213,7 +318313,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -313239,8 +318343,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -313255,8 +318359,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -313317,7 +318421,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -313419,8 +318527,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -313508,8 +318616,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -313527,14 +318635,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -313568,7 +318680,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -313660,7 +318772,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -313674,7 +318786,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -313716,14 +318832,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -313735,7 +318851,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -313882,7 +319002,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -313951,7 +319071,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -313960,7 +319080,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -313998,8 +319118,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -314057,7 +319177,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -314329,8 +319449,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -314427,7 +319547,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -314441,7 +319561,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -314467,8 +319591,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -314483,8 +319607,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -314545,7 +319669,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -314647,8 +319775,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -314736,8 +319864,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -314755,14 +319883,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -314796,7 +319928,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -314888,7 +320020,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -314902,7 +320034,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -314944,14 +320080,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -314963,7 +320099,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -315110,7 +320250,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -315179,7 +320319,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -315188,7 +320328,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -315226,8 +320366,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -315285,7 +320425,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -315557,8 +320697,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -315655,7 +320795,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -315669,7 +320809,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -315695,8 +320839,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -315711,8 +320855,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -315773,7 +320917,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -315875,8 +321023,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -315964,8 +321112,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -315983,14 +321131,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -316024,7 +321176,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -316116,7 +321268,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -316130,7 +321282,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -316172,14 +321328,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -316191,7 +321347,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -316338,7 +321498,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -316407,7 +321567,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -316416,7 +321576,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -316454,8 +321614,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -316513,7 +321673,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -316785,8 +321945,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -316883,7 +322043,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -316897,7 +322057,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -316923,8 +322087,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -316939,8 +322103,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -317001,7 +322165,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -317103,8 +322271,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -317192,8 +322360,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -317211,14 +322379,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -317252,7 +322424,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -317344,7 +322516,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -317358,7 +322530,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -317400,14 +322576,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -317419,7 +322595,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -317566,7 +322746,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -317635,7 +322815,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -317644,7 +322824,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -317682,8 +322862,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -317741,7 +322921,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -318013,8 +323193,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -318111,7 +323291,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -318125,7 +323305,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -318151,8 +323335,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -318167,8 +323351,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -318229,7 +323413,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -318331,8 +323519,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -318420,8 +323608,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -318439,14 +323627,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -318480,7 +323672,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -318572,7 +323764,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -318586,7 +323778,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -318628,14 +323824,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -318647,7 +323843,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -318794,7 +323994,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -318863,7 +324063,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -318872,7 +324072,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -318910,8 +324110,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -318969,7 +324169,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -319241,8 +324441,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -319339,7 +324539,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -319353,7 +324553,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -319379,8 +324583,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -319395,8 +324599,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -319457,7 +324661,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -319559,8 +324767,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -319648,8 +324856,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -319667,14 +324875,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -319708,7 +324920,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -319800,7 +325012,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -319814,7 +325026,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -319856,14 +325072,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -319875,7 +325091,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -320022,7 +325242,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -320091,7 +325311,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -320100,7 +325320,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -320138,8 +325358,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -320197,7 +325417,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -320469,8 +325689,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -320567,7 +325787,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -320581,7 +325801,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -320607,8 +325831,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -320623,8 +325847,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -320685,7 +325909,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -320787,8 +326015,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -320876,8 +326104,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -320895,14 +326123,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -320936,7 +326168,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -321028,7 +326260,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -321042,7 +326274,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -321084,14 +326320,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -321103,7 +326339,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -321250,7 +326490,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -321319,7 +326559,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -321328,7 +326568,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -321366,8 +326606,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -321425,7 +326665,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -321697,8 +326937,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -321795,7 +327035,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -321809,7 +327049,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -321835,8 +327079,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -321851,8 +327095,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -321913,7 +327157,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -322015,8 +327263,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -322104,8 +327352,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -322123,14 +327371,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -322164,7 +327416,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -322256,7 +327508,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -322270,7 +327522,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -322312,14 +327568,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -322331,7 +327587,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -322478,7 +327738,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -322547,7 +327807,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -322556,7 +327816,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -322594,8 +327854,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -322653,7 +327913,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -322925,8 +328185,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -323023,7 +328283,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -323037,7 +328297,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -323063,8 +328327,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -323079,8 +328343,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -323141,7 +328405,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -323243,8 +328511,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -323332,8 +328600,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -323351,14 +328619,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -323392,7 +328664,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -323484,7 +328756,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -323498,7 +328770,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -323540,14 +328816,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -323559,7 +328835,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -323706,7 +328986,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -323775,7 +329055,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -323784,7 +329064,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -323822,8 +329102,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -323881,7 +329161,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -324153,8 +329433,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -324251,7 +329531,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -324265,7 +329545,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -324291,8 +329575,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -324307,8 +329591,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -324369,7 +329653,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -324471,8 +329759,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -324560,8 +329848,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -324579,14 +329867,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -324620,7 +329912,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -324712,7 +330004,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -324726,7 +330018,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -324768,14 +330064,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -324787,7 +330083,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -324934,7 +330234,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -325003,7 +330303,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -325012,7 +330312,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -325050,8 +330350,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -325109,7 +330409,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -325381,8 +330681,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -325479,7 +330779,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -325493,7 +330793,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -325519,8 +330823,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -325535,8 +330839,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -325597,7 +330901,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -325699,8 +331007,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -325788,8 +331096,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -325807,14 +331115,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -325848,7 +331160,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -325940,7 +331252,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -325954,7 +331266,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -325996,14 +331312,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -326015,7 +331331,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -326162,7 +331482,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -326231,7 +331551,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -326240,7 +331560,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -326278,8 +331598,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -326337,7 +331657,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -326609,8 +331929,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -326707,7 +332027,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -326721,7 +332041,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -326747,8 +332071,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -326763,8 +332087,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -326825,7 +332149,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -326927,8 +332255,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -327016,8 +332344,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -327035,14 +332363,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -327076,7 +332408,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -327168,7 +332500,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -327182,7 +332514,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -327224,14 +332560,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -327243,7 +332579,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -327390,7 +332730,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -327459,7 +332799,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -327468,7 +332808,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -327506,8 +332846,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -327565,7 +332905,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -327837,8 +333177,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -327935,7 +333275,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -327949,7 +333289,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -327975,8 +333319,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -327991,8 +333335,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -328053,7 +333397,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -328155,8 +333503,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -328244,8 +333592,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -328263,14 +333611,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -328304,7 +333656,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -328396,7 +333748,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -328410,7 +333762,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -328452,14 +333808,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -328471,7 +333827,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -328618,7 +333978,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -328687,7 +334047,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -328696,7 +334056,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -328734,8 +334094,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -328793,7 +334153,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -329065,8 +334425,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -329163,7 +334523,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -329177,7 +334537,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -329203,8 +334567,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -329219,8 +334583,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -329281,7 +334645,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -329383,8 +334751,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -329472,8 +334840,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -329491,14 +334859,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -329532,7 +334904,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -329624,7 +334996,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -329638,7 +335010,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -329680,14 +335056,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -329699,7 +335075,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -329846,7 +335226,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -329915,7 +335295,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -329924,7 +335304,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -329962,8 +335342,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -330021,7 +335401,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -330293,8 +335673,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -330391,7 +335771,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -330405,7 +335785,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -330431,8 +335815,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -330447,8 +335831,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -330509,7 +335893,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -330611,8 +335999,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -330700,8 +336088,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -330719,14 +336107,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -330760,7 +336152,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -330852,7 +336244,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -330866,7 +336258,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -330908,14 +336304,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -330927,7 +336323,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -331074,7 +336474,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -331143,7 +336543,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -331152,7 +336552,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -331190,8 +336590,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -331249,7 +336649,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -331521,8 +336921,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -331619,7 +337019,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -331633,7 +337033,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -331659,8 +337063,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -331675,8 +337079,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -331737,7 +337141,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -331839,8 +337247,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -331928,8 +337336,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -331947,14 +337355,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -331988,7 +337400,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -332080,7 +337492,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -332094,7 +337506,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -332136,14 +337552,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -332155,7 +337571,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -332302,7 +337722,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -332371,7 +337791,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -332380,7 +337800,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -332418,8 +337838,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -332477,7 +337897,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -332749,8 +338169,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -332847,7 +338267,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -332861,7 +338281,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -332887,8 +338311,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -332903,8 +338327,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -332965,7 +338389,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -333067,8 +338495,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -333156,8 +338584,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -333175,14 +338603,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -333216,7 +338648,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -333308,7 +338740,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -333322,7 +338754,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -333364,14 +338800,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -333383,7 +338819,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -333530,7 +338970,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -333599,7 +339039,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -333608,7 +339048,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -333646,8 +339086,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -333705,7 +339145,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -333977,8 +339417,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -334075,7 +339515,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -334089,7 +339529,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -334115,8 +339559,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -334131,8 +339575,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -334193,7 +339637,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -334295,8 +339743,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -334384,8 +339832,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -334403,14 +339851,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -334444,7 +339896,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -334536,7 +339988,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -334550,7 +340002,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -334592,14 +340048,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -334611,7 +340067,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -334758,7 +340218,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -334827,7 +340287,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -334836,7 +340296,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -334874,8 +340334,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -334933,7 +340393,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -335205,8 +340665,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -335303,7 +340763,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -335317,7 +340777,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -335343,8 +340807,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -335359,8 +340823,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -335421,7 +340885,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -335523,8 +340991,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -335612,8 +341080,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -335631,14 +341099,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -335672,7 +341144,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -335764,7 +341236,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -335778,7 +341250,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -335820,14 +341296,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -335839,7 +341315,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -335986,7 +341466,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -336055,7 +341535,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -336064,7 +341544,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -336102,8 +341582,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -336161,7 +341641,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -336433,8 +341913,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -336531,7 +342011,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -336545,7 +342025,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -336571,8 +342055,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -336587,8 +342071,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -336649,7 +342133,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -336751,8 +342239,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -336840,8 +342328,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -336859,14 +342347,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -336900,7 +342392,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -336992,7 +342484,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -337006,7 +342498,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -337048,14 +342544,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -337067,7 +342563,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -337214,7 +342714,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -337283,7 +342783,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -337292,7 +342792,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -337330,8 +342830,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -337389,7 +342889,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -337661,8 +343161,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -337759,7 +343259,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -337773,7 +343273,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -337799,8 +343303,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -337815,8 +343319,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -337877,7 +343381,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -337979,8 +343487,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -338068,8 +343576,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -338087,14 +343595,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -338128,7 +343640,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -338220,7 +343732,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -338234,7 +343746,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -338276,14 +343792,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -338295,7 +343811,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -338442,7 +343962,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -338511,7 +344031,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -338520,7 +344040,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -338558,8 +344078,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -338617,7 +344137,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -338889,8 +344409,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -338987,7 +344507,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -339001,7 +344521,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -339027,8 +344551,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -339043,8 +344567,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -339105,7 +344629,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -339207,8 +344735,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -339296,8 +344824,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -339315,14 +344843,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -339356,7 +344888,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -339448,7 +344980,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -339462,7 +344994,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -339504,14 +345040,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -339523,7 +345059,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -339670,7 +345210,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -339739,7 +345279,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -339748,7 +345288,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -339786,8 +345326,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -339845,7 +345385,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -340117,8 +345657,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -340215,7 +345755,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -340229,7 +345769,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -340255,8 +345799,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -340271,8 +345815,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -340333,7 +345877,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -340435,8 +345983,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -340524,8 +346072,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -340543,14 +346091,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -340584,7 +346136,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -340676,7 +346228,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -340690,7 +346242,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -340732,14 +346288,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -340751,7 +346307,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -340898,7 +346458,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -340967,7 +346527,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -340976,7 +346536,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -341014,8 +346574,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -341073,7 +346633,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -341345,8 +346905,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -341443,7 +347003,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -341457,7 +347017,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -341483,8 +347047,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -341499,8 +347063,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -341561,7 +347125,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -341663,8 +347231,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -341752,8 +347320,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -341771,14 +347339,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -341812,7 +347384,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -341904,7 +347476,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -341918,7 +347490,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -341960,14 +347536,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -341979,7 +347555,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -342126,7 +347706,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -342195,7 +347775,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -342204,7 +347784,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -342242,8 +347822,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -342301,7 +347881,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -342573,8 +348153,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -342671,7 +348251,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -342685,7 +348265,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -342711,8 +348295,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -342727,8 +348311,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -342789,7 +348373,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -342891,8 +348479,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -342980,8 +348568,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -342999,14 +348587,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -343040,7 +348632,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -343132,7 +348724,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -343146,7 +348738,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -343188,14 +348784,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -343207,7 +348803,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -343354,7 +348954,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -343423,7 +349023,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -343432,7 +349032,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -343470,8 +349070,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -343529,7 +349129,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -343801,8 +349401,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -343899,7 +349499,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -343913,7 +349513,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -343939,8 +349543,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -343955,8 +349559,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -344017,7 +349621,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -344119,8 +349727,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -344208,8 +349816,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -344227,14 +349835,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -344268,7 +349880,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -344360,7 +349972,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -344374,7 +349986,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -344416,14 +350032,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -344435,7 +350051,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -344582,7 +350202,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -344651,7 +350271,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -344660,7 +350280,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -344698,8 +350318,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -344757,7 +350377,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -345029,8 +350649,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -345127,7 +350747,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -345141,7 +350761,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -345167,8 +350791,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -345183,8 +350807,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -345245,7 +350869,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -345347,8 +350975,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -345436,8 +351064,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -345455,14 +351083,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -345496,7 +351128,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -345588,7 +351220,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -345602,7 +351234,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -345644,14 +351280,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -345663,7 +351299,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -345810,7 +351450,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -345879,7 +351519,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -345888,7 +351528,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -345926,8 +351566,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -345985,7 +351625,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -346257,8 +351897,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -346355,7 +351995,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -346369,7 +352009,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -346395,8 +352039,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -346411,8 +352055,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -346473,7 +352117,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -346575,8 +352223,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -346664,8 +352312,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -346683,14 +352331,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -346724,7 +352376,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -346816,7 +352468,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -346830,7 +352482,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -346872,14 +352528,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -346891,7 +352547,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -347038,7 +352698,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -347107,7 +352767,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -347116,7 +352776,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -347154,8 +352814,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -347213,7 +352873,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -347485,8 +353145,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -347583,7 +353243,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -347597,7 +353257,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -347623,8 +353287,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -347639,8 +353303,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -347701,7 +353365,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -347803,8 +353471,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -347892,8 +353560,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -347911,14 +353579,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -347952,7 +353624,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -348044,7 +353716,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -348058,7 +353730,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -348100,14 +353776,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -348119,7 +353795,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -348266,7 +353946,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -348335,7 +354015,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -348344,7 +354024,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -348382,8 +354062,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -348441,7 +354121,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -348713,8 +354393,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -348811,7 +354491,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -348825,7 +354505,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -348851,8 +354535,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -348867,8 +354551,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -348929,7 +354613,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -349031,8 +354719,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -349120,8 +354808,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -349139,14 +354827,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -349180,7 +354872,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -349272,7 +354964,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -349286,7 +354978,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -349328,14 +355024,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -349347,7 +355043,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -349494,7 +355194,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -349563,7 +355263,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -349572,7 +355272,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -349610,8 +355310,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -349669,7 +355369,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -349941,8 +355641,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -350039,7 +355739,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -350053,7 +355753,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -350079,8 +355783,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -350095,8 +355799,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -350157,7 +355861,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -350259,8 +355967,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -350348,8 +356056,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -350367,14 +356075,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -350408,7 +356120,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -350500,7 +356212,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -350514,7 +356226,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -350556,14 +356272,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -350575,7 +356291,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -350722,7 +356442,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -350791,7 +356511,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -350800,7 +356520,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -350838,8 +356558,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -350897,7 +356617,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -351169,8 +356889,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -351267,7 +356987,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -351281,7 +357001,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -351307,8 +357031,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -351323,8 +357047,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -351385,7 +357109,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -351487,8 +357215,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -351576,8 +357304,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -351595,14 +357323,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -351636,7 +357368,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -351728,7 +357460,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -351742,7 +357474,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -351784,14 +357520,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -351803,7 +357539,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -351950,7 +357690,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -352019,7 +357759,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -352028,7 +357768,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -352066,8 +357806,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -352125,7 +357865,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -352397,8 +358137,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -352495,7 +358235,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -352509,7 +358249,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -352535,8 +358279,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -352551,8 +358295,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -352613,7 +358357,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -352715,8 +358463,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -352804,8 +358552,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -352823,14 +358571,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -352864,7 +358616,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -352956,7 +358708,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -352970,7 +358722,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -353012,14 +358768,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -353031,7 +358787,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -353178,7 +358938,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -353247,7 +359007,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -353256,7 +359016,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -353294,8 +359054,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -353353,7 +359113,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -353625,8 +359385,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -353723,7 +359483,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -353737,7 +359497,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -353763,8 +359527,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -353779,8 +359543,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -353841,7 +359605,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -353943,8 +359711,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -354032,8 +359800,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -354051,14 +359819,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -354092,7 +359864,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -354184,7 +359956,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -354198,7 +359970,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -354240,14 +360016,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -354259,7 +360035,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -354406,7 +360186,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -354475,7 +360255,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -354484,7 +360264,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -354522,8 +360302,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -354581,7 +360361,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -354853,8 +360633,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -354951,7 +360731,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -354965,7 +360745,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -354991,8 +360775,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -355007,8 +360791,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -355069,7 +360853,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -355171,8 +360959,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -355260,8 +361048,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -355279,14 +361067,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -355320,7 +361112,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -355412,7 +361204,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -355426,7 +361218,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -355468,14 +361264,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -355487,7 +361283,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -355634,7 +361434,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -355703,7 +361503,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -355712,7 +361512,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -355750,8 +361550,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -355809,7 +361609,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -356081,8 +361881,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -356179,7 +361979,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -356193,7 +361993,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -356219,8 +362023,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -356235,8 +362039,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -356297,7 +362101,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -356399,8 +362207,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -356488,8 +362296,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -356507,14 +362315,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -356548,7 +362360,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -356640,7 +362452,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -356654,7 +362466,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -356696,14 +362512,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -356715,7 +362531,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -356862,7 +362682,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -356931,7 +362751,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -356940,7 +362760,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -356978,8 +362798,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -357037,7 +362857,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -357309,8 +363129,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -357407,7 +363227,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -357421,7 +363241,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -357447,8 +363271,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -357463,8 +363287,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -357525,7 +363349,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -357627,8 +363455,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -357716,8 +363544,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -357735,14 +363563,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -357776,7 +363608,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -357868,7 +363700,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -357882,7 +363714,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -357924,14 +363760,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -357943,7 +363779,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -358090,7 +363930,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -358159,7 +363999,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -358168,7 +364008,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -358206,8 +364046,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -358265,7 +364105,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -358537,8 +364377,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -358635,7 +364475,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -358649,7 +364489,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -358675,8 +364519,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -358691,8 +364535,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -358753,7 +364597,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -358855,8 +364703,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -358944,8 +364792,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -358963,14 +364811,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -359004,7 +364856,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -359096,7 +364948,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -359110,7 +364962,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -359152,14 +365008,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -359171,7 +365027,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -359318,7 +365178,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -359387,7 +365247,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -359396,7 +365256,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -359434,8 +365294,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -359493,7 +365353,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -359765,8 +365625,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -359863,7 +365723,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -359877,7 +365737,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -359903,8 +365767,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -359919,8 +365783,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -359981,7 +365845,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -360083,8 +365951,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -360172,8 +366040,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -360191,14 +366059,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -360232,7 +366104,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -360324,7 +366196,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -360338,7 +366210,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -360380,14 +366256,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -360399,7 +366275,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -360546,7 +366426,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -360615,7 +366495,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -360624,7 +366504,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -360662,8 +366542,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -360721,7 +366601,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -360993,8 +366873,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -361091,7 +366971,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -361105,7 +366985,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -361131,8 +367015,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -361147,8 +367031,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -361209,7 +367093,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -361311,8 +367199,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -361400,8 +367288,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -361419,14 +367307,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -361460,7 +367352,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -361552,7 +367444,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -361566,7 +367458,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -361608,14 +367504,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -361627,7 +367523,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -361774,7 +367674,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -361843,7 +367743,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -361852,7 +367752,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -361890,8 +367790,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -361949,7 +367849,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -362221,8 +368121,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -362319,7 +368219,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -362333,7 +368233,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -362359,8 +368263,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -362375,8 +368279,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -362437,7 +368341,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -362539,8 +368447,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -362628,8 +368536,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -362647,14 +368555,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -362688,7 +368600,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -362780,7 +368692,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -362794,7 +368706,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -362836,14 +368752,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -362855,7 +368771,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -363002,7 +368922,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -363071,7 +368991,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -363080,7 +369000,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -363118,8 +369038,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -363177,7 +369097,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -363449,8 +369369,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -363547,7 +369467,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -363561,7 +369481,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -363587,8 +369511,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -363603,8 +369527,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -363665,7 +369589,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -363767,8 +369695,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -363856,8 +369784,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -363875,14 +369803,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -363916,7 +369848,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -364008,7 +369940,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -364022,7 +369954,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -364064,14 +370000,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -364083,7 +370019,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -364230,7 +370170,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -364299,7 +370239,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -364308,7 +370248,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -364346,8 +370286,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -364405,7 +370345,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -364677,8 +370617,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -364775,7 +370715,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -364789,7 +370729,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -364815,8 +370759,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -364831,8 +370775,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -364893,7 +370837,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -364995,8 +370943,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -365084,8 +371032,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -365103,14 +371051,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -365144,7 +371096,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -365236,7 +371188,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -365250,7 +371202,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -365292,14 +371248,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -365311,7 +371267,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -365458,7 +371418,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -365527,7 +371487,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -365536,7 +371496,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -365574,8 +371534,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -365633,7 +371593,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -365905,8 +371865,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -366003,7 +371963,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -366017,7 +371977,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -366043,8 +372007,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -366059,8 +372023,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -366121,7 +372085,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -366223,8 +372191,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -366312,8 +372280,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -366331,14 +372299,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -366372,7 +372344,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -366464,7 +372436,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -366478,7 +372450,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -366520,14 +372496,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -366539,7 +372515,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -366686,7 +372666,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -366755,7 +372735,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -366764,7 +372744,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -366802,8 +372782,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -366861,7 +372841,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -367133,8 +373113,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -367231,7 +373211,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -367245,7 +373225,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -367271,8 +373255,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -367287,8 +373271,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -367349,7 +373333,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -367451,8 +373439,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -367540,8 +373528,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -367559,14 +373547,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -367600,7 +373592,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -367692,7 +373684,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -367706,7 +373698,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -367748,14 +373744,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -367767,7 +373763,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -367914,7 +373914,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -367983,7 +373983,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -367992,7 +373992,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -368030,8 +374030,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -368089,7 +374089,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -368361,8 +374361,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -368459,7 +374459,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -368473,7 +374473,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -368499,8 +374503,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -368515,8 +374519,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -368577,7 +374581,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -368679,8 +374687,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -368768,8 +374776,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -368787,14 +374795,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -368828,7 +374840,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -368920,7 +374932,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -368934,7 +374946,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -368976,14 +374992,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -368995,7 +375011,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -369142,7 +375162,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -369211,7 +375231,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -369220,7 +375240,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -369258,8 +375278,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -369317,7 +375337,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -369589,8 +375609,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -369687,7 +375707,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -369701,7 +375721,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -369727,8 +375751,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -369743,8 +375767,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -369805,7 +375829,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -369907,8 +375935,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -369996,8 +376024,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -370015,14 +376043,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -370056,7 +376088,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -370148,7 +376180,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -370162,7 +376194,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -370204,14 +376240,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -370223,7 +376259,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -370370,7 +376410,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -370439,7 +376479,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -370448,7 +376488,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -370486,8 +376526,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -370545,7 +376585,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -370817,8 +376857,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -370915,7 +376955,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -370929,7 +376969,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -370955,8 +376999,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -370971,8 +377015,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -371033,7 +377077,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -371135,8 +377183,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -371224,8 +377272,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -371243,14 +377291,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -371284,7 +377336,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -371376,7 +377428,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -371390,7 +377442,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -371432,14 +377488,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -371451,7 +377507,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -371598,7 +377658,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -371667,7 +377727,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -371676,7 +377736,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -371714,8 +377774,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -371773,7 +377833,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -372045,8 +378105,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -372143,7 +378203,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -372157,7 +378217,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -372183,8 +378247,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -372199,8 +378263,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -372261,7 +378325,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -372363,8 +378431,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -372452,8 +378520,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -372471,14 +378539,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -372512,7 +378584,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -372604,7 +378676,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -372618,7 +378690,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -372660,14 +378736,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -372679,7 +378755,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -372826,7 +378906,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -372895,7 +378975,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -372904,7 +378984,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -372942,8 +379022,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -373001,7 +379081,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -373273,8 +379353,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -373371,7 +379451,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -373385,7 +379465,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -373411,8 +379495,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -373427,8 +379511,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -373489,7 +379573,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -373591,8 +379679,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -373680,8 +379768,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -373699,14 +379787,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -373740,7 +379832,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -373832,7 +379924,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -373846,7 +379938,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -373888,14 +379984,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -373907,7 +380003,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -374054,7 +380154,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -374123,7 +380223,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -374132,7 +380232,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -374170,8 +380270,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -374229,7 +380329,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -374501,8 +380601,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -374599,7 +380699,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -374613,7 +380713,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -374639,8 +380743,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -374655,8 +380759,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -374717,7 +380821,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -374819,8 +380927,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -374908,8 +381016,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -374927,14 +381035,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -374968,7 +381080,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -375060,7 +381172,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -375074,7 +381186,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -375116,14 +381232,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -375135,7 +381251,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -375282,7 +381402,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -375351,7 +381471,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -375360,7 +381480,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -375398,8 +381518,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -375457,7 +381577,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -375729,8 +381849,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -375827,7 +381947,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -375841,7 +381961,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -375867,8 +381991,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -375883,8 +382007,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -375945,7 +382069,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -376047,8 +382175,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -376136,8 +382264,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -376155,14 +382283,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -376196,7 +382328,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -376288,7 +382420,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -376302,7 +382434,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -376344,14 +382480,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -376363,7 +382499,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -376510,7 +382650,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -376579,7 +382719,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -376588,7 +382728,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -376626,8 +382766,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -376685,7 +382825,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -376957,8 +383097,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -377055,7 +383195,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -377069,7 +383209,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -377095,8 +383239,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -377111,8 +383255,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -377173,7 +383317,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -377275,8 +383423,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -377364,8 +383512,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -377383,14 +383531,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -377424,7 +383576,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -377516,7 +383668,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -377530,7 +383682,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -377572,14 +383728,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -377591,7 +383747,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -377738,7 +383898,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -377807,7 +383967,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -377816,7 +383976,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -377854,8 +384014,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -377913,7 +384073,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -378185,8 +384345,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -378283,7 +384443,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -378297,7 +384457,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -378323,8 +384487,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -378339,8 +384503,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -378401,7 +384565,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -378503,8 +384671,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -378592,8 +384760,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -378611,14 +384779,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -378652,7 +384824,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -378744,7 +384916,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -378758,7 +384930,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -378800,14 +384976,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -378819,7 +384995,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -378966,7 +385146,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -379035,7 +385215,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -379044,7 +385224,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -379082,8 +385262,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -379141,7 +385321,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -379413,8 +385593,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -379511,7 +385691,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -379525,7 +385705,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -379551,8 +385735,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -379567,8 +385751,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -379629,7 +385813,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -379731,8 +385919,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -379820,8 +386008,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -379839,14 +386027,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -379880,7 +386072,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -379972,7 +386164,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -379986,7 +386178,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -380028,14 +386224,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -380047,7 +386243,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -380194,7 +386394,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -380263,7 +386463,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -380272,7 +386472,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -380310,8 +386510,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -380369,7 +386569,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -380641,8 +386841,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -380739,7 +386939,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -380753,7 +386953,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -380779,8 +386983,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -380795,8 +386999,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -380857,7 +387061,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -380959,8 +387167,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -381048,8 +387256,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -381067,14 +387275,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -381108,7 +387320,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -381200,7 +387412,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -381214,7 +387426,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -381256,14 +387472,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -381275,7 +387491,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -381422,7 +387642,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -381491,7 +387711,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -381500,7 +387720,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -381538,8 +387758,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -381597,7 +387817,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -381869,8 +388089,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -381967,7 +388187,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -381981,7 +388201,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -382007,8 +388231,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -382023,8 +388247,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -382085,7 +388309,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -382187,8 +388415,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -382276,8 +388504,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -382295,14 +388523,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -382336,7 +388568,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -382428,7 +388660,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -382442,7 +388674,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -382484,14 +388720,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -382503,7 +388739,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -382650,7 +388890,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -382719,7 +388959,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -382728,7 +388968,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -382766,8 +389006,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -382825,7 +389065,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -383097,8 +389337,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -383195,7 +389435,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -383209,7 +389449,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -383235,8 +389479,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -383251,8 +389495,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -383313,7 +389557,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -383415,8 +389663,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -383504,8 +389752,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -383523,14 +389771,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -383564,7 +389816,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -383656,7 +389908,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -383670,7 +389922,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -383712,14 +389968,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -383731,7 +389987,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -383878,7 +390138,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -383947,7 +390207,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -383956,7 +390216,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -383994,8 +390254,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -384053,7 +390313,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -384325,8 +390585,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -384423,7 +390683,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -384437,7 +390697,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -384463,8 +390727,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -384479,8 +390743,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -384541,7 +390805,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -384643,8 +390911,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -384732,8 +391000,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -384751,14 +391019,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -384792,7 +391064,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -384884,7 +391156,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -384898,7 +391170,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -384940,14 +391216,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -384959,7 +391235,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -385106,7 +391386,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -385175,7 +391455,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -385184,7 +391464,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -385222,8 +391502,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -385281,7 +391561,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -385553,8 +391833,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -385651,7 +391931,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -385665,7 +391945,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -385691,8 +391975,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -385707,8 +391991,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -385769,7 +392053,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -385871,8 +392159,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -385960,8 +392248,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -385979,14 +392267,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -386020,7 +392312,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -386112,7 +392404,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -386126,7 +392418,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -386168,14 +392464,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -386187,7 +392483,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -386334,7 +392634,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -386403,7 +392703,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -386412,7 +392712,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -386450,8 +392750,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -386509,7 +392809,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -386781,8 +393081,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -386879,7 +393179,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -386893,7 +393193,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -386919,8 +393223,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -386935,8 +393239,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -386997,7 +393301,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -387099,8 +393407,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -387188,8 +393496,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -387207,14 +393515,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -387248,7 +393560,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -387340,7 +393652,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -387354,7 +393666,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -387396,14 +393712,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -387415,7 +393731,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -387562,7 +393882,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -387631,7 +393951,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -387640,7 +393960,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -387678,8 +393998,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -387737,7 +394057,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -388009,8 +394329,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -388107,7 +394427,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -388121,7 +394441,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -388147,8 +394471,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -388163,8 +394487,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -388225,7 +394549,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -388327,8 +394655,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -388416,8 +394744,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -388435,14 +394763,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -388476,7 +394808,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -388568,7 +394900,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -388582,7 +394914,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -388624,14 +394960,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -388643,7 +394979,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -388790,7 +395130,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -388859,7 +395199,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -388868,7 +395208,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -388906,8 +395246,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -388965,7 +395305,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -389237,8 +395577,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -389335,7 +395675,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -389349,7 +395689,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -389375,8 +395719,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -389391,8 +395735,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -389453,7 +395797,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -389555,8 +395903,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -389644,8 +395992,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -389663,14 +396011,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -389704,7 +396056,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -389796,7 +396148,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -389810,7 +396162,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -389852,14 +396208,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -389871,7 +396227,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -390018,7 +396378,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -390087,7 +396447,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -390096,7 +396456,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -390134,8 +396494,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -390193,7 +396553,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -390465,8 +396825,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -390563,7 +396923,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -390577,7 +396937,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -390603,8 +396967,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -390619,8 +396983,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -390681,7 +397045,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -390783,8 +397151,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -390872,8 +397240,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -390891,14 +397259,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -390932,7 +397304,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -391024,7 +397396,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -391038,7 +397410,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -391080,14 +397456,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -391099,7 +397475,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -391246,7 +397626,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -391315,7 +397695,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -391324,7 +397704,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -391362,8 +397742,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -391421,7 +397801,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -391693,8 +398073,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -391791,7 +398171,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -391805,7 +398185,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -391831,8 +398215,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -391847,8 +398231,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -391909,7 +398293,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -392011,8 +398399,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -392100,8 +398488,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -392119,14 +398507,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -392160,7 +398552,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -392252,7 +398644,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -392266,7 +398658,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -392308,14 +398704,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -392327,7 +398723,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -392474,7 +398874,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -392543,7 +398943,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -392552,7 +398952,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -392590,8 +398990,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -392649,7 +399049,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -392921,8 +399321,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -393019,7 +399419,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -393033,7 +399433,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -393059,8 +399463,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -393075,8 +399479,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -393137,7 +399541,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -393239,8 +399647,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -393328,8 +399736,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -393347,14 +399755,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -393388,7 +399800,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -393480,7 +399892,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -393494,7 +399906,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -393536,14 +399952,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -393555,7 +399971,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -393702,7 +400122,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -393771,7 +400191,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -393780,7 +400200,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -393818,8 +400238,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -393877,7 +400297,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -394149,8 +400569,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -394247,7 +400667,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -394261,7 +400681,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -394287,8 +400711,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -394303,8 +400727,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -394365,7 +400789,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -394467,8 +400895,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -394556,8 +400984,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -394575,14 +401003,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -394616,7 +401048,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -394708,7 +401140,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -394722,7 +401154,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -394764,14 +401200,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -394783,7 +401219,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -394930,7 +401370,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -394999,7 +401439,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -395008,7 +401448,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -395046,8 +401486,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -395105,7 +401545,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -395377,8 +401817,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -395475,7 +401915,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -395489,7 +401929,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -395515,8 +401959,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -395531,8 +401975,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -395593,7 +402037,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -395695,8 +402143,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -395784,8 +402232,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -395803,14 +402251,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -395844,7 +402296,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -395936,7 +402388,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -395950,7 +402402,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -395992,14 +402448,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -396011,7 +402467,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -396158,7 +402618,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -396227,7 +402687,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -396236,7 +402696,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -396274,8 +402734,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -396333,7 +402793,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -396605,8 +403065,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -396703,7 +403163,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -396717,7 +403177,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -396743,8 +403207,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -396759,8 +403223,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -396821,7 +403285,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -396923,8 +403391,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -397012,8 +403480,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -397031,14 +403499,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -397072,7 +403544,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -397164,7 +403636,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -397178,7 +403650,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -397220,14 +403696,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -397239,7 +403715,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -397386,7 +403866,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -397455,7 +403935,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -397464,7 +403944,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -397502,8 +403982,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -397561,7 +404041,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -397833,8 +404313,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -397931,7 +404411,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -397945,7 +404425,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -397971,8 +404455,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -397987,8 +404471,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -398049,7 +404533,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -398151,8 +404639,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -398240,8 +404728,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -398259,14 +404747,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -398300,7 +404792,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -398392,7 +404884,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -398406,7 +404898,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -398448,14 +404944,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -398467,7 +404963,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -398614,7 +405114,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -398683,7 +405183,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -398692,7 +405192,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -398730,8 +405230,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -398789,7 +405289,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -399061,8 +405561,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -399159,7 +405659,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -399173,7 +405673,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -399199,8 +405703,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -399215,8 +405719,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -399277,7 +405781,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -399379,8 +405887,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -399468,8 +405976,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -399487,14 +405995,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -399528,7 +406040,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -399620,7 +406132,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -399634,7 +406146,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -399676,14 +406192,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -399695,7 +406211,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -399842,7 +406362,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -399911,7 +406431,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -399920,7 +406440,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -399958,8 +406478,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -400017,7 +406537,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -400289,8 +406809,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -400387,7 +406907,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -400401,7 +406921,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -400427,8 +406951,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -400443,8 +406967,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -400505,7 +407029,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -400607,8 +407135,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -400696,8 +407224,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -400715,14 +407243,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -400756,7 +407288,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -400848,7 +407380,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -400862,7 +407394,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -400904,14 +407440,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -400923,7 +407459,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -401070,7 +407610,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -401139,7 +407679,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -401148,7 +407688,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -401186,8 +407726,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -401245,7 +407785,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -401517,8 +408057,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -401615,7 +408155,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -401629,7 +408169,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -401655,8 +408199,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -401671,8 +408215,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -401733,7 +408277,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -401835,8 +408383,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -401924,8 +408472,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -401943,14 +408491,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -401984,7 +408536,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -402076,7 +408628,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -402090,7 +408642,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -402132,14 +408688,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -402151,7 +408707,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -402298,7 +408858,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -402367,7 +408927,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -402376,7 +408936,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -402414,8 +408974,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -402473,7 +409033,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -402745,8 +409305,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -402843,7 +409403,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -402857,7 +409417,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -402883,8 +409447,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -402899,8 +409463,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -402961,7 +409525,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -403063,8 +409631,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -403152,8 +409720,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -403171,14 +409739,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -403212,7 +409784,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -403304,7 +409876,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -403318,7 +409890,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -403360,14 +409936,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -403379,7 +409955,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -403526,7 +410106,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -403595,7 +410175,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -403604,7 +410184,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -403642,8 +410222,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -403701,7 +410281,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -403973,8 +410553,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -404071,7 +410651,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -404085,7 +410665,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -404111,8 +410695,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -404127,8 +410711,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -404189,7 +410773,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -404291,8 +410879,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -404380,8 +410968,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -404399,14 +410987,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -404440,7 +411032,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -404532,7 +411124,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -404546,7 +411138,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -404588,14 +411184,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -404607,7 +411203,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -404754,7 +411354,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -404823,7 +411423,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -404832,7 +411432,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -404870,8 +411470,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -404929,7 +411529,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -405201,8 +411801,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -405299,7 +411899,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -405313,7 +411913,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -405339,8 +411943,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -405355,8 +411959,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -405417,7 +412021,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -405519,8 +412127,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -405608,8 +412216,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -405627,14 +412235,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -405668,7 +412280,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -405760,7 +412372,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -405774,7 +412386,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -405816,14 +412432,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -405835,7 +412451,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -405982,7 +412602,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -406051,7 +412671,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -406060,7 +412680,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -406098,8 +412718,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -406157,7 +412777,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -406429,8 +413049,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -406527,7 +413147,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -406541,7 +413161,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -406567,8 +413191,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -406583,8 +413207,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -406645,7 +413269,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -406747,8 +413375,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -406836,8 +413464,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -406855,14 +413483,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -406896,7 +413528,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -406988,7 +413620,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -407002,7 +413634,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -407044,14 +413680,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -407063,7 +413699,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -407210,7 +413850,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -407279,7 +413919,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -407288,7 +413928,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -407326,8 +413966,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -407385,7 +414025,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -407657,8 +414297,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -407755,7 +414395,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -407769,7 +414409,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -407795,8 +414439,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -407811,8 +414455,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -407873,7 +414517,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -407975,8 +414623,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -408064,8 +414712,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -408083,14 +414731,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -408124,7 +414776,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -408216,7 +414868,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -408230,7 +414882,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -408272,14 +414928,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -408291,7 +414947,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -408438,7 +415098,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -408507,7 +415167,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -408516,7 +415176,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -408554,8 +415214,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -408613,7 +415273,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -408885,8 +415545,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -408983,7 +415643,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -408997,7 +415657,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -409023,8 +415687,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -409039,8 +415703,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -409101,7 +415765,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -409203,8 +415871,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -409292,8 +415960,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -409311,14 +415979,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -409352,7 +416024,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -409444,7 +416116,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -409458,7 +416130,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -409500,14 +416176,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -409519,7 +416195,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -409666,7 +416346,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -409735,7 +416415,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -409744,7 +416424,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -409782,8 +416462,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -409841,7 +416521,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -410113,8 +416793,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -410211,7 +416891,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -410225,7 +416905,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -410251,8 +416935,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -410267,8 +416951,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -410329,7 +417013,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -410431,8 +417119,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -410520,8 +417208,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -410539,14 +417227,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -410580,7 +417272,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -410672,7 +417364,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -410686,7 +417378,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -410728,14 +417424,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -410747,7 +417443,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -410894,7 +417594,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -410963,7 +417663,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -410972,7 +417672,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -411010,8 +417710,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -411069,7 +417769,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -411341,8 +418041,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -411439,7 +418139,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -411453,7 +418153,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -411479,8 +418183,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -411495,8 +418199,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -411557,7 +418261,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -411659,8 +418367,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -411748,8 +418456,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -411767,14 +418475,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -411808,7 +418520,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -411900,7 +418612,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -411914,7 +418626,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -411956,14 +418672,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -411975,7 +418691,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -412122,7 +418842,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -412191,7 +418911,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -412200,7 +418920,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -412238,8 +418958,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -412297,7 +419017,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -412569,8 +419289,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -412667,7 +419387,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -412681,7 +419401,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -412707,8 +419431,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -412723,8 +419447,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -412785,7 +419509,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -412887,8 +419615,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -412976,8 +419704,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -412995,14 +419723,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -413036,7 +419768,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -413128,7 +419860,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -413142,7 +419874,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -413184,14 +419920,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -413203,7 +419939,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -413350,7 +420090,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -413419,7 +420159,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -413428,7 +420168,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -413466,8 +420206,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -413525,7 +420265,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -413797,8 +420537,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -413895,7 +420635,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -413909,7 +420649,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -413935,8 +420679,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -413951,8 +420695,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -414013,7 +420757,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -414115,8 +420863,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -414204,8 +420952,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -414223,14 +420971,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -414264,7 +421016,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -414356,7 +421108,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -414370,7 +421122,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -414412,14 +421168,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -414431,7 +421187,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -414578,7 +421338,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -414647,7 +421407,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -414656,7 +421416,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -414694,8 +421454,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -414753,7 +421513,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -415025,8 +421785,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -415123,7 +421883,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -415137,7 +421897,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -415163,8 +421927,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -415179,8 +421943,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -415241,7 +422005,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -415343,8 +422111,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -415432,8 +422200,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -415451,14 +422219,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -415492,7 +422264,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -415584,7 +422356,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -415598,7 +422370,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -415640,14 +422416,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -415659,7 +422435,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -415806,7 +422586,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -415875,7 +422655,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -415884,7 +422664,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -415922,8 +422702,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -415981,7 +422761,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -416253,8 +423033,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -416351,7 +423131,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -416365,7 +423145,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -416391,8 +423175,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -416407,8 +423191,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -416469,7 +423253,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -416571,8 +423359,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -416660,8 +423448,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -416679,14 +423467,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -416720,7 +423512,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -416812,7 +423604,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -416826,7 +423618,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -416868,14 +423664,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -416887,7 +423683,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -417034,7 +423834,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -417103,7 +423903,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -417112,7 +423912,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -417150,8 +423950,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -417209,7 +424009,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -417481,8 +424281,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -417579,7 +424379,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -417593,7 +424393,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -417619,8 +424423,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -417635,8 +424439,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -417697,7 +424501,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -417799,8 +424607,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -417888,8 +424696,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -417907,14 +424715,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -417948,7 +424760,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -418040,7 +424852,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -418054,7 +424866,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -418096,14 +424912,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -418115,7 +424931,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -418262,7 +425082,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -418331,7 +425151,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -418340,7 +425160,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -418378,8 +425198,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -418437,7 +425257,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -418709,8 +425529,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -418807,7 +425627,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -418821,7 +425641,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -418847,8 +425671,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -418863,8 +425687,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -418925,7 +425749,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -419027,8 +425855,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -419116,8 +425944,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -419135,14 +425963,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -419176,7 +426008,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -419268,7 +426100,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -419282,7 +426114,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -419324,14 +426160,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -419343,7 +426179,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -419490,7 +426330,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -419559,7 +426399,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -419568,7 +426408,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -419606,8 +426446,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -419665,7 +426505,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -419937,8 +426777,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -420035,7 +426875,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -420049,7 +426889,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -420075,8 +426919,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -420091,8 +426935,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -420153,7 +426997,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -420255,8 +427103,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -420344,8 +427192,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -420363,14 +427211,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -420404,7 +427256,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -420496,7 +427348,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -420510,7 +427362,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -420552,14 +427408,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -420571,7 +427427,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -420718,7 +427578,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -420787,7 +427647,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -420796,7 +427656,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -420834,8 +427694,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -420893,7 +427753,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -421165,8 +428025,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -421263,7 +428123,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -421277,7 +428137,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -421303,8 +428167,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -421319,8 +428183,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -421381,7 +428245,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -421483,8 +428351,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -421572,8 +428440,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -421591,14 +428459,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -421632,7 +428504,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -421724,7 +428596,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -421738,7 +428610,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -421780,14 +428656,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -421799,7 +428675,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -421946,7 +428826,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -422015,7 +428895,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -422024,7 +428904,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -422062,8 +428942,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -422121,7 +429001,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -422393,8 +429273,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -422491,7 +429371,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -422505,7 +429385,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -422531,8 +429415,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -422547,8 +429431,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -422609,7 +429493,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -422711,8 +429599,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -422800,8 +429688,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -422819,14 +429707,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -422860,7 +429752,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -422952,7 +429844,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -422966,7 +429858,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -423008,14 +429904,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -423027,7 +429923,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -423174,7 +430074,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -423243,7 +430143,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -423252,7 +430152,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -423290,8 +430190,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -423349,7 +430249,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -423621,8 +430521,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -423719,7 +430619,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -423733,7 +430633,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -423759,8 +430663,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -423775,8 +430679,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -423837,7 +430741,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -423939,8 +430847,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -424028,8 +430936,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -424047,14 +430955,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -424088,7 +431000,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -424180,7 +431092,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -424194,7 +431106,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -424236,14 +431152,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -424255,7 +431171,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -424402,7 +431322,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -424471,7 +431391,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -424480,7 +431400,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -424518,8 +431438,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -424577,7 +431497,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -424849,8 +431769,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -424947,7 +431867,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -424961,7 +431881,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -424987,8 +431911,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -425003,8 +431927,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -425065,7 +431989,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -425167,8 +432095,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -425256,8 +432184,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -425275,14 +432203,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -425316,7 +432248,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -425408,7 +432340,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -425422,7 +432354,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -425464,14 +432400,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -425483,7 +432419,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -425630,7 +432570,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -425699,7 +432639,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -425708,7 +432648,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -425746,8 +432686,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -425805,7 +432745,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -426077,8 +433017,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -426175,7 +433115,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -426189,7 +433129,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -426215,8 +433159,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -426231,8 +433175,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -426293,7 +433237,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -426395,8 +433343,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -426484,8 +433432,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -426503,14 +433451,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -426544,7 +433496,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -426636,7 +433588,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -426650,7 +433602,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -426692,14 +433648,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -426711,7 +433667,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -426858,7 +433818,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -426927,7 +433887,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -426936,7 +433896,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -426974,8 +433934,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -427033,7 +433993,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -427305,8 +434265,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -427403,7 +434363,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -427417,7 +434377,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -427443,8 +434407,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -427459,8 +434423,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -427521,7 +434485,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -427623,8 +434591,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -427712,8 +434680,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -427731,14 +434699,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -427772,7 +434744,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -427864,7 +434836,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -427878,7 +434850,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -427920,14 +434896,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -427939,7 +434915,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -428086,7 +435066,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -428155,7 +435135,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -428164,7 +435144,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -428202,8 +435182,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -428261,7 +435241,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -428533,8 +435513,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -428631,7 +435611,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -428645,7 +435625,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -428671,8 +435655,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -428687,8 +435671,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -428749,7 +435733,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -428851,8 +435839,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -428940,8 +435928,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -428959,14 +435947,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -429000,7 +435992,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -429092,7 +436084,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -429106,7 +436098,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -429148,14 +436144,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -429167,7 +436163,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -429314,7 +436314,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -429383,7 +436383,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -429392,7 +436392,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -429430,8 +436430,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -429489,7 +436489,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -429761,8 +436761,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -429859,7 +436859,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -429873,7 +436873,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -429899,8 +436903,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -429915,8 +436919,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -429977,7 +436981,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -430079,8 +437087,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -430168,8 +437176,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -430187,14 +437195,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -430228,7 +437240,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -430320,7 +437332,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -430334,7 +437346,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -430376,14 +437392,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -430395,7 +437411,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -430542,7 +437562,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -430611,7 +437631,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -430620,7 +437640,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -430658,8 +437678,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -430717,7 +437737,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -430989,8 +438009,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -431087,7 +438107,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -431101,7 +438121,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -431127,8 +438151,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -431143,8 +438167,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -431205,7 +438229,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -431307,8 +438335,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -431396,8 +438424,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -431415,14 +438443,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -431456,7 +438488,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -431548,7 +438580,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -431562,7 +438594,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -431604,14 +438640,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -431623,7 +438659,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -431770,7 +438810,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -431839,7 +438879,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -431848,7 +438888,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -431886,8 +438926,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -431945,7 +438985,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -432217,8 +439257,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -432315,7 +439355,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -432329,7 +439369,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -432355,8 +439399,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -432371,8 +439415,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -432433,7 +439477,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -432535,8 +439583,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -432624,8 +439672,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -432643,14 +439691,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -432684,7 +439736,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -432776,7 +439828,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -432790,7 +439842,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -432832,14 +439888,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -432851,7 +439907,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -432998,7 +440058,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -433067,7 +440127,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -433076,7 +440136,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -433114,8 +440174,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -433173,7 +440233,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -433445,8 +440505,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -433543,7 +440603,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -433557,7 +440617,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -433583,8 +440647,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -433599,8 +440663,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -433661,7 +440725,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -433763,8 +440831,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -433852,8 +440920,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -433871,14 +440939,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -433912,7 +440984,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -434004,7 +441076,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -434018,7 +441090,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -434060,14 +441136,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -434079,7 +441155,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -434226,7 +441306,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -434295,7 +441375,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -434304,7 +441384,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -434342,8 +441422,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -434401,7 +441481,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -434673,8 +441753,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -434771,7 +441851,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -434785,7 +441865,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -434811,8 +441895,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -434827,8 +441911,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -434889,7 +441973,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -434991,8 +442079,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -435080,8 +442168,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -435099,14 +442187,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -435140,7 +442232,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -435232,7 +442324,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -435246,7 +442338,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -435288,14 +442384,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -435307,7 +442403,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -435454,7 +442554,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -435523,7 +442623,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -435532,7 +442632,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -435570,8 +442670,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -435629,7 +442729,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -435901,8 +443001,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -435999,7 +443099,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -436013,7 +443113,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -436039,8 +443143,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -436055,8 +443159,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -436117,7 +443221,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -436219,8 +443327,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -436308,8 +443416,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -436327,14 +443435,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -436368,7 +443480,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -436460,7 +443572,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -436474,7 +443586,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -436516,14 +443632,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -436535,7 +443651,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -436682,7 +443802,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -436751,7 +443871,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -436760,7 +443880,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -436798,8 +443918,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -436857,7 +443977,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -437129,8 +444249,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -437227,7 +444347,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -437241,7 +444361,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -437267,8 +444391,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -437283,8 +444407,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -437345,7 +444469,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -437447,8 +444575,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -437536,8 +444664,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -437555,14 +444683,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -437596,7 +444728,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -437688,7 +444820,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -437702,7 +444834,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -437744,14 +444880,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -437763,7 +444899,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -437910,7 +445050,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -437979,7 +445119,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -437988,7 +445128,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -438026,8 +445166,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -438085,7 +445225,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -438357,8 +445497,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -438455,7 +445595,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -438469,7 +445609,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -438495,8 +445639,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -438511,8 +445655,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -438573,7 +445717,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -438675,8 +445823,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -438764,8 +445912,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -438783,14 +445931,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -438824,7 +445976,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -438916,7 +446068,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -438930,7 +446082,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -438972,14 +446128,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -438991,7 +446147,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -439138,7 +446298,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -439207,7 +446367,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -439216,7 +446376,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -439254,8 +446414,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -439313,7 +446473,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -439585,8 +446745,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -439683,7 +446843,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -439697,7 +446857,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -439723,8 +446887,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -439739,8 +446903,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -439801,7 +446965,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -439903,8 +447071,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -439992,8 +447160,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -440011,14 +447179,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -440052,7 +447224,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -440144,7 +447316,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -440158,7 +447330,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -440200,14 +447376,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -440219,7 +447395,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -440366,7 +447546,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -440435,7 +447615,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -440444,7 +447624,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -440482,8 +447662,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -440541,7 +447721,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -440813,8 +447993,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -440911,7 +448091,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -440925,7 +448105,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -440951,8 +448135,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -440967,8 +448151,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -441029,7 +448213,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -441131,8 +448319,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -441220,8 +448408,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -441239,14 +448427,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -441280,7 +448472,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -441372,7 +448564,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -441386,7 +448578,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -441428,14 +448624,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -441447,7 +448643,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -441594,7 +448794,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -441663,7 +448863,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -441672,7 +448872,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -441710,8 +448910,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -441769,7 +448969,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -442041,8 +449241,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -442139,7 +449339,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -442153,7 +449353,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -442179,8 +449383,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -442195,8 +449399,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -442257,7 +449461,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -442359,8 +449567,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -442448,8 +449656,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -442467,14 +449675,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -442508,7 +449720,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -442600,7 +449812,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -442614,7 +449826,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -442656,14 +449872,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -442675,7 +449891,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -442822,7 +450042,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -442891,7 +450111,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -442900,7 +450120,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -442938,8 +450158,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -442997,7 +450217,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -443269,8 +450489,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -443367,7 +450587,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -443381,7 +450601,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -443407,8 +450631,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -443423,8 +450647,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -443485,7 +450709,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -443587,8 +450815,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -443676,8 +450904,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -443695,14 +450923,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -443736,7 +450968,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -443828,7 +451060,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -443842,7 +451074,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -443884,14 +451120,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -443903,7 +451139,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -444050,7 +451290,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -444119,7 +451359,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -444128,7 +451368,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -444166,8 +451406,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -444225,7 +451465,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -444497,8 +451737,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -444595,7 +451835,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -444609,7 +451849,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -444635,8 +451879,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -444651,8 +451895,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -444713,7 +451957,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -444815,8 +452063,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -444904,8 +452152,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -444923,14 +452171,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -444964,7 +452216,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -445056,7 +452308,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -445070,7 +452322,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -445112,14 +452368,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -445131,7 +452387,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -445278,7 +452538,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -445347,7 +452607,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -445356,7 +452616,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -445394,8 +452654,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -445453,7 +452713,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -445725,8 +452985,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -445823,7 +453083,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -445837,7 +453097,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -445863,8 +453127,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -445879,8 +453143,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -445941,7 +453205,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -446043,8 +453311,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -446132,8 +453400,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -446151,14 +453419,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -446192,7 +453464,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -446284,7 +453556,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -446298,7 +453570,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -446340,14 +453616,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -446359,7 +453635,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -446506,7 +453786,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -446575,7 +453855,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -446584,7 +453864,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -446622,8 +453902,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -446681,7 +453961,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -446953,8 +454233,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -447051,7 +454331,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -447065,7 +454345,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -447091,8 +454375,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -447107,8 +454391,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -447169,7 +454453,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -447271,8 +454559,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -447360,8 +454648,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -447379,14 +454667,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -447420,7 +454712,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -447512,7 +454804,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -447526,7 +454818,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -447568,14 +454864,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -447587,7 +454883,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -447734,7 +455034,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -447803,7 +455103,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -447812,7 +455112,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -447850,8 +455150,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -447909,7 +455209,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -448181,8 +455481,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -448279,7 +455579,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -448293,7 +455593,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -448319,8 +455623,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -448335,8 +455639,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -448397,7 +455701,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -448499,8 +455807,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -448588,8 +455896,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -448607,14 +455915,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -448648,7 +455960,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -448740,7 +456052,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -448754,7 +456066,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -448796,14 +456112,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -448815,7 +456131,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -448962,7 +456282,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -449031,7 +456351,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -449040,7 +456360,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -449078,8 +456398,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -449137,7 +456457,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -449409,8 +456729,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
@@ -449507,7 +456827,7 @@
         {},
         {
             "techniqueID": "T1003",
-            "score": 31,
+            "score": 32,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml"
         },
         {},
@@ -449521,7 +456841,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1590.005",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
+        },
         {},
         {},
         {},
@@ -449547,8 +456871,8 @@
         {},
         {
             "techniqueID": "T1548.002",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {},
         {},
@@ -449563,8 +456887,8 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {},
         {},
@@ -449625,7 +456949,11 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1087.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
+        },
         {},
         {},
         {},
@@ -449727,8 +457055,8 @@
         {},
         {
             "techniqueID": "T1053",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
         },
         {},
         {},
@@ -449816,8 +457144,8 @@
         {},
         {
             "techniqueID": "T1055",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "score": 14,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {},
         {},
@@ -449835,14 +457163,18 @@
         {},
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {},
         {},
         {},
         {
             "techniqueID": "T1021.002",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1525",
@@ -449876,7 +457208,7 @@
         {},
         {
             "techniqueID": "T1021",
-            "score": 5,
+            "score": 6,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml"
         },
         {},
@@ -449968,7 +457300,7 @@
         {},
         {
             "techniqueID": "T1548",
-            "score": 7,
+            "score": 9,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
         },
         {},
@@ -449982,7 +457314,11 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml"
         },
-        {},
+        {
+            "techniqueID": "T1110.003",
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
         {},
         {},
         {},
@@ -450024,14 +457360,14 @@
         {},
         {
             "techniqueID": "T1087",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {},
         {
             "techniqueID": "T1059",
-            "score": 18,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "score": 19,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {},
         {},
@@ -450043,7 +457379,11 @@
         },
         {},
         {},
-        {},
+        {
+            "techniqueID": "T1020",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
         {},
         {
             "techniqueID": "T1562.007",
@@ -450190,7 +457530,7 @@
         {},
         {
             "techniqueID": "T1590",
-            "score": 4,
+            "score": 5,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
@@ -450259,7 +457599,7 @@
         {},
         {
             "techniqueID": "T1110",
-            "score": 2,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml"
         },
         {},
@@ -450268,7 +457608,7 @@
         {
             "techniqueID": "T1562.001",
             "score": 14,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {},
         {},
@@ -450306,8 +457646,8 @@
         {},
         {
             "techniqueID": "T1027",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1114.002",
@@ -450365,7 +457705,7 @@
         {
             "techniqueID": "T1036.003",
             "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {},
         {
@@ -450637,8 +457977,8 @@
         {},
         {
             "techniqueID": "T1490",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml"
         },
         {},
         {
diff --git a/docs/mitre-map/detections.csv b/docs/mitre-map/detections.csv
index 2a52593e0f..9fc219953f 100644
--- a/docs/mitre-map/detections.csv
+++ b/docs/mitre-map/detections.csv
@@ -1,371 +1,738 @@
 Technique ID,Detection Available,Link,score
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,63
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,63
 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
@@ -36338,18 +36705,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36358,18 +36727,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36378,18 +36749,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36398,18 +36771,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36418,18 +36793,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36438,18 +36815,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36458,18 +36837,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36478,18 +36859,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36498,18 +36881,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36518,18 +36903,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36538,18 +36925,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36558,18 +36947,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36578,18 +36969,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36598,18 +36991,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36618,18 +37013,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36638,18 +37035,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36658,18 +37057,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36678,18 +37079,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36698,18 +37101,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36718,18 +37123,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36738,18 +37145,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36758,18 +37167,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36778,18 +37189,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36798,18 +37211,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36818,18 +37233,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36838,18 +37255,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36858,18 +37277,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36878,18 +37299,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36898,18 +37321,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36918,18 +37343,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36938,18 +37365,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36958,18 +37387,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36978,18 +37409,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -36998,18 +37431,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37018,18 +37453,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37038,18 +37475,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37058,18 +37497,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37078,18 +37519,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37098,18 +37541,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37118,18 +37563,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37138,18 +37585,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37158,18 +37607,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37178,18 +37629,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37198,18 +37651,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37218,18 +37673,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37238,18 +37695,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37258,18 +37717,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37278,18 +37739,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37298,18 +37761,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37318,18 +37783,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37338,18 +37805,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37358,18 +37827,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37378,18 +37849,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37398,18 +37871,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37418,18 +37893,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37438,18 +37915,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37458,18 +37937,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37478,18 +37959,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37498,18 +37981,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37518,18 +38003,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37538,18 +38025,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37558,18 +38047,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37578,18 +38069,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37598,18 +38091,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37618,18 +38113,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37638,18 +38135,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37658,18 +38157,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37678,18 +38179,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37698,18 +38201,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37718,18 +38223,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37738,18 +38245,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37758,18 +38267,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37778,18 +38289,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37798,18 +38311,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37818,18 +38333,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37838,18 +38355,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37858,18 +38377,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37878,18 +38399,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37898,18 +38421,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37918,18 +38443,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37938,18 +38465,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37958,18 +38487,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37978,18 +38509,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -37998,18 +38531,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38018,18 +38553,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38038,18 +38575,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38058,18 +38597,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38078,18 +38619,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38098,18 +38641,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38118,18 +38663,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38138,18 +38685,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38158,18 +38707,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38178,18 +38729,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38198,18 +38751,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38218,18 +38773,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38238,18 +38795,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38258,18 +38817,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38278,18 +38839,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38298,18 +38861,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38318,18 +38883,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38338,18 +38905,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38358,18 +38927,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38378,18 +38949,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38398,18 +38971,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38418,18 +38993,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38438,18 +39015,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38458,18 +39037,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38478,18 +39059,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38498,18 +39081,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38518,18 +39103,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38538,18 +39125,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38558,18 +39147,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38578,18 +39169,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38598,18 +39191,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38618,18 +39213,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38638,18 +39235,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38658,18 +39257,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38678,18 +39279,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38698,18 +39301,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38718,18 +39323,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38738,18 +39345,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38758,18 +39367,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38778,18 +39389,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38798,18 +39411,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38818,18 +39433,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38838,18 +39455,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38858,18 +39477,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38878,18 +39499,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38898,18 +39521,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38918,18 +39543,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38938,18 +39565,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38958,18 +39587,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38978,18 +39609,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -38998,18 +39631,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39018,18 +39653,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39038,18 +39675,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39058,18 +39697,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39078,18 +39719,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39098,18 +39741,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39118,18 +39763,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39138,18 +39785,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39158,18 +39807,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39178,18 +39829,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39198,18 +39851,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39218,18 +39873,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39238,18 +39895,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39258,18 +39917,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39278,18 +39939,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39298,18 +39961,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39318,18 +39983,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39338,18 +40005,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39358,18 +40027,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39378,18 +40049,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39398,18 +40071,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39418,18 +40093,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39438,18 +40115,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39458,18 +40137,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39478,18 +40159,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39498,18 +40181,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39518,18 +40203,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39538,18 +40225,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39558,18 +40247,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39578,18 +40269,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39598,18 +40291,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39618,18 +40313,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39638,18 +40335,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39658,18 +40357,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39678,18 +40379,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39698,18 +40401,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39718,18 +40423,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39738,18 +40445,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39758,18 +40467,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39778,18 +40489,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39798,18 +40511,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39818,18 +40533,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39838,18 +40555,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39858,18 +40577,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39878,18 +40599,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39898,18 +40621,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39918,18 +40643,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39938,18 +40665,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39958,18 +40687,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39978,18 +40709,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -39998,18 +40731,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40018,18 +40753,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40038,18 +40775,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40058,18 +40797,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40078,18 +40819,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40098,18 +40841,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40118,18 +40863,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40138,18 +40885,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40158,18 +40907,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40178,18 +40929,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40198,18 +40951,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40218,18 +40973,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40238,18 +40995,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40258,18 +41017,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40278,18 +41039,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40298,18 +41061,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40318,18 +41083,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40338,18 +41105,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40358,18 +41127,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40378,18 +41149,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40398,18 +41171,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40418,18 +41193,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40438,18 +41215,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40458,18 +41237,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40478,18 +41259,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40498,18 +41281,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40518,18 +41303,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40538,18 +41325,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40558,18 +41347,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40578,18 +41369,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40598,18 +41391,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40618,18 +41413,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40638,18 +41435,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40658,18 +41457,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40678,18 +41479,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40698,18 +41501,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40718,18 +41523,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40738,18 +41545,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40758,18 +41567,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40778,18 +41589,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40798,18 +41611,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40818,18 +41633,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40838,18 +41655,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40858,18 +41677,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40878,18 +41699,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40898,18 +41721,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40918,18 +41743,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40938,18 +41765,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40958,18 +41787,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40978,18 +41809,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -40998,18 +41831,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41018,18 +41853,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41038,18 +41875,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41058,18 +41897,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41078,18 +41919,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41098,18 +41941,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41118,18 +41963,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41138,18 +41985,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41158,18 +42007,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41178,18 +42029,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41198,18 +42051,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41218,18 +42073,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41238,18 +42095,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41258,18 +42117,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41278,18 +42139,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41298,18 +42161,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41318,18 +42183,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41338,18 +42205,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41358,18 +42227,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41378,18 +42249,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41398,18 +42271,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41418,18 +42293,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41438,18 +42315,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41458,18 +42337,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41478,18 +42359,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41498,18 +42381,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41518,18 +42403,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41538,18 +42425,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41558,18 +42447,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41578,18 +42469,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41598,18 +42491,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41618,18 +42513,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41638,18 +42535,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41658,18 +42557,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41678,18 +42579,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41698,18 +42601,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41718,18 +42623,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41738,18 +42645,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41758,18 +42667,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41778,18 +42689,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41798,18 +42711,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41818,18 +42733,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41838,18 +42755,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41858,18 +42777,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41878,18 +42799,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41898,18 +42821,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41918,18 +42843,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41938,18 +42865,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41958,18 +42887,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41978,18 +42909,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -41998,18 +42931,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42018,18 +42953,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42038,18 +42975,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42058,18 +42997,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42078,18 +43019,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42098,18 +43041,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42118,18 +43063,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42138,18 +43085,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42158,18 +43107,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42178,18 +43129,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42198,18 +43151,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42218,18 +43173,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42238,18 +43195,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42258,18 +43217,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42278,18 +43239,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42298,18 +43261,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42318,18 +43283,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42338,18 +43305,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42358,18 +43327,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42378,18 +43349,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42398,18 +43371,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42418,18 +43393,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42438,18 +43415,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42458,18 +43437,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42478,18 +43459,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42498,18 +43481,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42518,18 +43503,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42538,18 +43525,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42558,18 +43547,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42578,18 +43569,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42598,18 +43591,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42618,18 +43613,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42638,18 +43635,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42658,18 +43657,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42678,18 +43679,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42698,18 +43701,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42718,18 +43723,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42738,18 +43745,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42758,18 +43767,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42778,18 +43789,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42798,18 +43811,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42818,18 +43833,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42838,18 +43855,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42858,18 +43877,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42878,18 +43899,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42898,18 +43921,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42918,18 +43943,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42938,18 +43965,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42958,18 +43987,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42978,18 +44009,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -42998,18 +44031,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43018,18 +44053,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43038,18 +44075,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43058,18 +44097,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43078,18 +44119,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43098,18 +44141,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43118,18 +44163,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43138,18 +44185,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43158,18 +44207,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43178,18 +44229,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43198,18 +44251,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43218,18 +44273,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43238,18 +44295,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43258,18 +44317,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43278,18 +44339,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43298,18 +44361,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43318,18 +44383,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43338,18 +44405,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43358,18 +44427,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43378,18 +44449,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43398,18 +44471,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43418,18 +44493,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43438,18 +44515,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43458,18 +44537,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43478,18 +44559,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43498,18 +44581,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43518,18 +44603,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43538,18 +44625,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43558,18 +44647,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43578,18 +44669,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43598,18 +44691,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43618,18 +44713,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43638,18 +44735,20 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
@@ -43658,1854 +44757,2223 @@ T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/rem
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
 T1056.001,No,-,22
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,8
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,8
 T1076,No,-,22
 T1021.001,No,-,22
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,16
 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
 T1116,No,-,19
 T1553.002,No,-,19
@@ -56159,11 +57627,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56182,11 +57651,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56205,11 +57675,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56228,11 +57699,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56251,11 +57723,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56274,11 +57747,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56297,11 +57771,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56320,11 +57795,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56343,11 +57819,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56366,11 +57843,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56389,11 +57867,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56412,11 +57891,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56435,11 +57915,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56458,11 +57939,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56481,11 +57963,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56504,11 +57987,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56527,11 +58011,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56550,11 +58035,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56573,11 +58059,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56596,11 +58083,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56619,11 +58107,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56642,11 +58131,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56665,11 +58155,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56688,11 +58179,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56711,11 +58203,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56734,11 +58227,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56757,11 +58251,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56780,11 +58275,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56803,11 +58299,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56826,11 +58323,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56849,11 +58347,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56872,11 +58371,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56895,11 +58395,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56918,11 +58419,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56941,11 +58443,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56964,11 +58467,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -56987,11 +58491,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57010,11 +58515,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57033,11 +58539,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57056,11 +58563,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57079,11 +58587,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57102,11 +58611,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57125,11 +58635,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57148,11 +58659,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57171,11 +58683,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57194,11 +58707,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57217,11 +58731,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57240,11 +58755,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57263,11 +58779,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57286,11 +58803,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57309,11 +58827,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57332,11 +58851,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57355,11 +58875,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57378,11 +58899,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57401,11 +58923,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57424,11 +58947,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57447,11 +58971,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57470,11 +58995,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57493,11 +59019,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57516,11 +59043,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57539,11 +59067,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57562,11 +59091,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57585,11 +59115,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57608,11 +59139,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57631,11 +59163,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57654,11 +59187,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57677,11 +59211,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57700,11 +59235,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57723,11 +59259,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57746,11 +59283,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57769,11 +59307,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57792,11 +59331,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57815,11 +59355,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57838,11 +59379,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57861,11 +59403,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57884,11 +59427,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57907,11 +59451,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57930,11 +59475,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57953,11 +59499,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57976,11 +59523,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -57999,11 +59547,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58022,11 +59571,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58045,11 +59595,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58068,11 +59619,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58091,11 +59643,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58114,11 +59667,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58137,11 +59691,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58160,11 +59715,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58183,11 +59739,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58206,11 +59763,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58229,11 +59787,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58252,11 +59811,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58275,11 +59835,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58298,11 +59859,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58321,11 +59883,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58344,11 +59907,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58367,11 +59931,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58390,11 +59955,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58413,11 +59979,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58436,11 +60003,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58459,11 +60027,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58482,11 +60051,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58505,11 +60075,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58528,11 +60099,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58551,11 +60123,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58574,11 +60147,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58597,11 +60171,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58620,11 +60195,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58643,11 +60219,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58666,11 +60243,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58689,11 +60267,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58712,11 +60291,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58735,11 +60315,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58758,11 +60339,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58781,11 +60363,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58804,11 +60387,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58827,11 +60411,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58850,11 +60435,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58873,11 +60459,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58896,11 +60483,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58919,11 +60507,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58942,11 +60531,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58965,11 +60555,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -58988,11 +60579,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59011,11 +60603,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59034,11 +60627,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59057,11 +60651,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59080,11 +60675,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59103,11 +60699,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59126,11 +60723,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59149,11 +60747,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59172,11 +60771,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59195,11 +60795,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59218,11 +60819,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59241,11 +60843,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59264,11 +60867,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59287,11 +60891,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59310,11 +60915,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59333,11 +60939,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59356,11 +60963,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59379,11 +60987,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59402,11 +61011,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59425,11 +61035,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59448,11 +61059,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59471,11 +61083,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59494,11 +61107,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59517,11 +61131,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59540,11 +61155,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59563,11 +61179,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59586,11 +61203,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59609,11 +61227,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59632,11 +61251,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59655,11 +61275,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59678,11 +61299,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59701,11 +61323,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59724,11 +61347,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59747,11 +61371,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59770,11 +61395,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59793,11 +61419,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59816,11 +61443,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59839,11 +61467,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59862,11 +61491,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59885,11 +61515,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59908,11 +61539,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59931,11 +61563,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59954,11 +61587,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -59977,11 +61611,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60000,11 +61635,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60023,11 +61659,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60046,11 +61683,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60069,11 +61707,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60092,11 +61731,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60115,11 +61755,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60138,11 +61779,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60161,11 +61803,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60184,11 +61827,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60207,11 +61851,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60230,11 +61875,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60253,11 +61899,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60276,11 +61923,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60299,11 +61947,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60322,11 +61971,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60345,11 +61995,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60368,11 +62019,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60391,11 +62043,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60414,11 +62067,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60437,11 +62091,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60460,11 +62115,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60483,11 +62139,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60506,11 +62163,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60529,11 +62187,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60552,11 +62211,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60575,11 +62235,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60598,11 +62259,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60621,11 +62283,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60644,11 +62307,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60667,11 +62331,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60690,11 +62355,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60713,11 +62379,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60736,11 +62403,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60759,11 +62427,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60782,11 +62451,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60805,11 +62475,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60828,11 +62499,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60851,11 +62523,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60874,11 +62547,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60897,11 +62571,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60920,11 +62595,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60943,11 +62619,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60966,11 +62643,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -60989,11 +62667,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61012,11 +62691,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61035,11 +62715,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61058,11 +62739,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61081,11 +62763,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61104,11 +62787,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61127,11 +62811,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61150,11 +62835,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61173,11 +62859,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61196,11 +62883,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61219,11 +62907,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61242,11 +62931,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61265,11 +62955,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61288,11 +62979,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61311,11 +63003,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61334,11 +63027,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61357,11 +63051,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61380,11 +63075,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61403,11 +63099,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61426,11 +63123,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61449,11 +63147,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61472,11 +63171,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61495,11 +63195,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61518,11 +63219,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61541,11 +63243,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61564,11 +63267,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61587,11 +63291,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61610,11 +63315,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61633,11 +63339,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61656,11 +63363,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61679,11 +63387,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61702,11 +63411,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61725,11 +63435,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61748,11 +63459,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61771,11 +63483,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61794,11 +63507,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61817,11 +63531,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61840,11 +63555,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61863,11 +63579,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61886,11 +63603,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61909,11 +63627,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61932,11 +63651,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61955,11 +63675,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -61978,11 +63699,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62001,11 +63723,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62024,11 +63747,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62047,11 +63771,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62070,11 +63795,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62093,11 +63819,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62116,11 +63843,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62139,11 +63867,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62162,11 +63891,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62185,11 +63915,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62208,11 +63939,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62231,11 +63963,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62254,11 +63987,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62277,11 +64011,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62300,11 +64035,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62323,11 +64059,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62346,11 +64083,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62369,11 +64107,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62392,11 +64131,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62415,11 +64155,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62438,11 +64179,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62461,11 +64203,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62484,11 +64227,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62507,11 +64251,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62530,11 +64275,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62553,11 +64299,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62576,11 +64323,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62599,11 +64347,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62622,11 +64371,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62645,11 +64395,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62668,11 +64419,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62691,11 +64443,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62714,11 +64467,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62737,11 +64491,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62760,11 +64515,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62783,11 +64539,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62806,11 +64563,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62829,11 +64587,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62852,11 +64611,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62875,11 +64635,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62898,11 +64659,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62921,11 +64683,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62944,11 +64707,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62967,11 +64731,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -62990,11 +64755,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63013,11 +64779,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63036,11 +64803,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63059,11 +64827,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63082,11 +64851,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63105,11 +64875,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63128,11 +64899,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63151,11 +64923,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63174,11 +64947,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63197,11 +64971,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63220,11 +64995,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63243,11 +65019,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63266,11 +65043,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63289,11 +65067,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63312,11 +65091,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63335,11 +65115,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63358,11 +65139,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63381,11 +65163,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63404,11 +65187,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63427,11 +65211,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63450,11 +65235,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63473,11 +65259,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63496,11 +65283,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63519,11 +65307,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63542,11 +65331,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63565,11 +65355,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63588,11 +65379,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63611,11 +65403,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63634,11 +65427,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63657,11 +65451,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63680,11 +65475,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63703,11 +65499,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63726,11 +65523,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63749,11 +65547,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63772,11 +65571,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63795,11 +65595,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63818,11 +65619,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63841,11 +65643,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63864,11 +65667,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63887,11 +65691,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63910,11 +65715,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63933,11 +65739,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63956,11 +65763,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -63979,11 +65787,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64002,11 +65811,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64025,11 +65835,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64048,11 +65859,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64071,11 +65883,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64094,11 +65907,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64117,11 +65931,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64140,11 +65955,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64163,11 +65979,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64186,11 +66003,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64209,11 +66027,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64232,11 +66051,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64255,11 +66075,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64278,11 +66099,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64301,11 +66123,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64324,11 +66147,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64347,11 +66171,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64370,11 +66195,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64393,11 +66219,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64416,11 +66243,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64439,11 +66267,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64462,11 +66291,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64485,11 +66315,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64508,11 +66339,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64531,11 +66363,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64554,11 +66387,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -64577,11 +66411,12 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
-T1087.002,No,-,16
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,15
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,11
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,11
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
 T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
 T1085,No,-,16
@@ -68274,8 +70109,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68292,8 +70127,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68310,8 +70145,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68328,8 +70163,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68346,8 +70181,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68364,8 +70199,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68382,8 +70217,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68400,8 +70235,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68418,8 +70253,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68436,8 +70271,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68454,8 +70289,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68472,8 +70307,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68490,8 +70325,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68508,8 +70343,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68526,8 +70361,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68544,8 +70379,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68562,8 +70397,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68580,8 +70415,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68598,8 +70433,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68616,8 +70451,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68634,8 +70469,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68652,8 +70487,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68670,8 +70505,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68688,8 +70523,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68706,8 +70541,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68724,8 +70559,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68742,8 +70577,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68760,8 +70595,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68778,8 +70613,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68796,8 +70631,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68814,8 +70649,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68832,8 +70667,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68850,8 +70685,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68868,8 +70703,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68886,8 +70721,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68904,8 +70739,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68922,8 +70757,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68940,8 +70775,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68958,8 +70793,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68976,8 +70811,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -68994,8 +70829,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69012,8 +70847,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69030,8 +70865,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69048,8 +70883,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69066,8 +70901,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69084,8 +70919,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69102,8 +70937,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69120,8 +70955,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69138,8 +70973,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69156,8 +70991,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69174,8 +71009,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69192,8 +71027,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69210,8 +71045,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69228,8 +71063,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69246,8 +71081,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69264,8 +71099,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69282,8 +71117,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69300,8 +71135,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69318,8 +71153,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69336,8 +71171,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69354,8 +71189,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69372,8 +71207,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69390,8 +71225,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69408,8 +71243,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69426,8 +71261,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69444,8 +71279,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69462,8 +71297,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69480,8 +71315,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69498,8 +71333,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69516,8 +71351,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69534,8 +71369,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69552,8 +71387,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69570,8 +71405,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69588,8 +71423,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69606,8 +71441,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69624,8 +71459,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69642,8 +71477,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69660,8 +71495,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69678,8 +71513,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69696,8 +71531,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69714,8 +71549,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69732,8 +71567,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69750,8 +71585,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69768,8 +71603,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69786,8 +71621,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69804,8 +71639,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69822,8 +71657,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69840,8 +71675,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69858,8 +71693,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69876,8 +71711,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69894,8 +71729,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69912,8 +71747,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69930,8 +71765,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69948,8 +71783,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69966,8 +71801,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -69984,8 +71819,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70002,8 +71837,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70020,8 +71855,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70038,8 +71873,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70056,8 +71891,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70074,8 +71909,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70092,8 +71927,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70110,8 +71945,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70128,8 +71963,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70146,8 +71981,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70164,8 +71999,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70182,8 +72017,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70200,8 +72035,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70218,8 +72053,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70236,8 +72071,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70254,8 +72089,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70272,8 +72107,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70290,8 +72125,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70308,8 +72143,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70326,8 +72161,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70344,8 +72179,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70362,8 +72197,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70380,8 +72215,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70398,8 +72233,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70416,8 +72251,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70434,8 +72269,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70452,8 +72287,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70470,8 +72305,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70488,8 +72323,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70506,8 +72341,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70524,8 +72359,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70542,8 +72377,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70560,8 +72395,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70578,8 +72413,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70596,8 +72431,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70614,8 +72449,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70632,8 +72467,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70650,8 +72485,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70668,8 +72503,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70686,8 +72521,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70704,8 +72539,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70722,8 +72557,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70740,8 +72575,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70758,8 +72593,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70776,8 +72611,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70794,8 +72629,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70812,8 +72647,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70830,8 +72665,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70848,8 +72683,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70866,8 +72701,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70884,8 +72719,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70902,8 +72737,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70920,8 +72755,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70938,8 +72773,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70956,8 +72791,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70974,8 +72809,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -70992,8 +72827,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71010,8 +72845,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71028,8 +72863,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71046,8 +72881,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71064,8 +72899,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71082,8 +72917,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71100,8 +72935,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71118,8 +72953,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71136,8 +72971,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71154,8 +72989,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71172,8 +73007,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71190,8 +73025,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71208,8 +73043,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71226,8 +73061,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71244,8 +73079,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71262,8 +73097,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71280,8 +73115,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71298,8 +73133,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71316,8 +73151,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71334,8 +73169,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71352,8 +73187,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71370,8 +73205,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71388,8 +73223,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71406,8 +73241,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71424,8 +73259,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71442,8 +73277,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71460,8 +73295,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71478,8 +73313,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71496,8 +73331,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71514,8 +73349,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71532,8 +73367,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71550,8 +73385,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71568,8 +73403,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71586,8 +73421,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71604,8 +73439,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71622,8 +73457,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71640,8 +73475,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71658,8 +73493,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71676,8 +73511,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71694,8 +73529,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71712,8 +73547,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71730,8 +73565,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71748,8 +73583,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71766,8 +73601,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71784,8 +73619,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71802,8 +73637,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71820,8 +73655,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71838,8 +73673,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71856,8 +73691,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71874,8 +73709,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71892,8 +73727,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71910,8 +73745,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71928,8 +73763,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71946,8 +73781,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71964,8 +73799,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -71982,8 +73817,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72000,8 +73835,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72018,8 +73853,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72036,8 +73871,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72054,8 +73889,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72072,8 +73907,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72090,8 +73925,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72108,8 +73943,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72126,8 +73961,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72144,8 +73979,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72162,8 +73997,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72180,8 +74015,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72198,8 +74033,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72216,8 +74051,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72234,8 +74069,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72252,8 +74087,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72270,8 +74105,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72288,8 +74123,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72306,8 +74141,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72324,8 +74159,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72342,8 +74177,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72360,8 +74195,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72378,8 +74213,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72396,8 +74231,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72414,8 +74249,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72432,8 +74267,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72450,8 +74285,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72468,8 +74303,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72486,8 +74321,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72504,8 +74339,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72522,8 +74357,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72540,8 +74375,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72558,8 +74393,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72576,8 +74411,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72594,8 +74429,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72612,8 +74447,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72630,8 +74465,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72648,8 +74483,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72666,8 +74501,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72684,8 +74519,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72702,8 +74537,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72720,8 +74555,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72738,8 +74573,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72756,8 +74591,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72774,8 +74609,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72792,8 +74627,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72810,8 +74645,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72828,8 +74663,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72846,8 +74681,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72864,8 +74699,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72882,8 +74717,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72900,8 +74735,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72918,8 +74753,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72936,8 +74771,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72954,8 +74789,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72972,8 +74807,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -72990,8 +74825,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73008,8 +74843,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73026,8 +74861,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73044,8 +74879,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73062,8 +74897,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73080,8 +74915,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73098,8 +74933,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73116,8 +74951,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73134,8 +74969,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73152,8 +74987,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73170,8 +75005,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73188,8 +75023,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73206,8 +75041,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73224,8 +75059,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73242,8 +75077,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73260,8 +75095,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73278,8 +75113,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73296,8 +75131,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73314,8 +75149,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73332,8 +75167,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73350,8 +75185,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73368,8 +75203,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73386,8 +75221,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73404,8 +75239,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73422,8 +75257,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73440,8 +75275,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73458,8 +75293,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73476,8 +75311,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73494,8 +75329,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73512,8 +75347,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73530,8 +75365,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73548,8 +75383,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73566,8 +75401,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73584,8 +75419,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73602,8 +75437,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73620,8 +75455,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73638,8 +75473,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73656,8 +75491,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73674,8 +75509,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73692,8 +75527,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73710,8 +75545,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73728,8 +75563,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73746,8 +75581,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73764,8 +75599,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73782,8 +75617,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73800,8 +75635,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73818,8 +75653,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73836,8 +75671,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73854,8 +75689,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73872,8 +75707,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73890,8 +75725,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73908,8 +75743,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73926,8 +75761,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73944,8 +75779,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73962,8 +75797,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73980,8 +75815,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -73998,8 +75833,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74016,8 +75851,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74034,8 +75869,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74052,8 +75887,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74070,8 +75905,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74088,8 +75923,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74106,8 +75941,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74124,8 +75959,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74142,8 +75977,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74160,8 +75995,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74178,8 +76013,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74196,8 +76031,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74214,8 +76049,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74232,8 +76067,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74250,8 +76085,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74268,8 +76103,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74286,8 +76121,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74304,8 +76139,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74322,8 +76157,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74340,8 +76175,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74358,8 +76193,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74376,8 +76211,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74394,8 +76229,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74412,8 +76247,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74430,8 +76265,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74448,8 +76283,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74466,8 +76301,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74484,8 +76319,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74502,8 +76337,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74520,8 +76355,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74538,8 +76373,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74556,8 +76391,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74574,8 +76409,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74592,8 +76427,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74610,8 +76445,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74628,8 +76463,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74646,8 +76481,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74664,8 +76499,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74682,8 +76517,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74700,8 +76535,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74718,8 +76553,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74736,8 +76571,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74754,8 +76589,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74772,8 +76607,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74790,8 +76625,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74808,8 +76643,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74826,8 +76661,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74844,8 +76679,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -74862,8 +76697,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
 T1027.002,No,-,14
@@ -89181,9 +91016,11 @@ T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
 T1173,No,-,10
 T1124,No,-,10
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89209,9 +91046,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89237,9 +91076,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89265,9 +91106,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89293,9 +91136,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89321,9 +91166,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89349,9 +91196,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89377,9 +91226,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89405,9 +91256,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89433,9 +91286,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89461,9 +91316,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89489,9 +91346,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89517,9 +91376,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89545,9 +91406,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89573,9 +91436,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89601,9 +91466,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89629,9 +91496,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89657,9 +91526,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89685,9 +91556,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89713,9 +91586,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89741,9 +91616,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89769,9 +91646,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89797,9 +91676,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89825,9 +91706,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89853,9 +91736,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89881,9 +91766,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89909,9 +91796,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89937,9 +91826,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89965,9 +91856,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -89993,9 +91886,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90021,9 +91916,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90049,9 +91946,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90077,9 +91976,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90105,9 +92006,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90133,9 +92036,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90161,9 +92066,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90189,9 +92096,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90217,9 +92126,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90245,9 +92156,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90273,9 +92186,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90301,9 +92216,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90329,9 +92246,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90357,9 +92276,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90385,9 +92306,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90413,9 +92336,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90441,9 +92366,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90469,9 +92396,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90497,9 +92426,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90525,9 +92456,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90553,9 +92486,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90581,9 +92516,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90609,9 +92546,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90637,9 +92576,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90665,9 +92606,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90693,9 +92636,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90721,9 +92666,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90749,9 +92696,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90777,9 +92726,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90805,9 +92756,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90833,9 +92786,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90861,9 +92816,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90889,9 +92846,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90917,9 +92876,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90945,9 +92906,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -90973,9 +92936,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91001,9 +92966,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91029,9 +92996,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91057,9 +93026,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91085,9 +93056,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91113,9 +93086,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91141,9 +93116,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91169,9 +93146,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91197,9 +93176,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91225,9 +93206,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91253,9 +93236,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91281,9 +93266,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91309,9 +93296,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91337,9 +93326,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91365,9 +93356,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91393,9 +93386,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91421,9 +93416,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91449,9 +93446,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91477,9 +93476,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91505,9 +93506,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91533,9 +93536,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91561,9 +93566,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91589,9 +93596,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91617,9 +93626,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91645,9 +93656,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91673,9 +93686,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91701,9 +93716,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91729,9 +93746,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91757,9 +93776,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91785,9 +93806,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91813,9 +93836,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91841,9 +93866,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91869,9 +93896,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91897,9 +93926,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91925,9 +93956,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91953,9 +93986,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -91981,9 +94016,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92009,9 +94046,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92037,9 +94076,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92065,9 +94106,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92093,9 +94136,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92121,9 +94166,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92149,9 +94196,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92177,9 +94226,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92205,9 +94256,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92233,9 +94286,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92261,9 +94316,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92289,9 +94346,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92317,9 +94376,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92345,9 +94406,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92373,9 +94436,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92401,9 +94466,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92429,9 +94496,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92457,9 +94526,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92485,9 +94556,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92513,9 +94586,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92541,9 +94616,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92569,9 +94646,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92597,9 +94676,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92625,9 +94706,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92653,9 +94736,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92681,9 +94766,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92709,9 +94796,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92737,9 +94826,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92765,9 +94856,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92793,9 +94886,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92821,9 +94916,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92849,9 +94946,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92877,9 +94976,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92905,9 +95006,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92933,9 +95036,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92961,9 +95066,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -92989,9 +95096,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93017,9 +95126,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93045,9 +95156,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93073,9 +95186,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93101,9 +95216,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93129,9 +95246,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93157,9 +95276,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93185,9 +95306,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93213,9 +95336,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93241,9 +95366,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93269,9 +95396,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93297,9 +95426,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93325,9 +95456,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93353,9 +95486,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93381,9 +95516,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93409,9 +95546,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93437,9 +95576,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93465,9 +95606,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93493,9 +95636,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93521,9 +95666,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93549,9 +95696,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93577,9 +95726,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93605,9 +95756,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93633,9 +95786,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93661,9 +95816,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93689,9 +95846,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93717,9 +95876,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93745,9 +95906,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93773,9 +95936,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93801,9 +95966,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93829,9 +95996,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93857,9 +96026,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93885,9 +96056,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93913,9 +96086,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93941,9 +96116,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93969,9 +96146,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -93997,9 +96176,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94025,9 +96206,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94053,9 +96236,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94081,9 +96266,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94109,9 +96296,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94137,9 +96326,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94165,9 +96356,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94193,9 +96386,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94221,9 +96416,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94249,9 +96446,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94277,9 +96476,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94305,9 +96506,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94333,9 +96536,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94361,9 +96566,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94389,9 +96596,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94417,9 +96626,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94445,9 +96656,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94473,9 +96686,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94501,9 +96716,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94529,9 +96746,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94557,9 +96776,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94585,9 +96806,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94613,9 +96836,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94641,9 +96866,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94669,9 +96896,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94697,9 +96926,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94725,9 +96956,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94753,9 +96986,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94781,9 +97016,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94809,9 +97046,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94837,9 +97076,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94865,9 +97106,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94893,9 +97136,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94921,9 +97166,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94949,9 +97196,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -94977,9 +97226,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95005,9 +97256,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95033,9 +97286,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95061,9 +97316,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95089,9 +97346,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95117,9 +97376,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95145,9 +97406,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95173,9 +97436,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95201,9 +97466,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95229,9 +97496,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95257,9 +97526,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95285,9 +97556,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95313,9 +97586,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95341,9 +97616,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95369,9 +97646,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95397,9 +97676,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95425,9 +97706,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95453,9 +97736,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95481,9 +97766,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95509,9 +97796,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95537,9 +97826,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95565,9 +97856,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95593,9 +97886,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95621,9 +97916,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95649,9 +97946,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95677,9 +97976,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95705,9 +98006,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95733,9 +98036,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95761,9 +98066,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95789,9 +98096,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95817,9 +98126,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95845,9 +98156,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95873,9 +98186,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95901,9 +98216,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95929,9 +98246,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95957,9 +98276,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -95985,9 +98306,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96013,9 +98336,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96041,9 +98366,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96069,9 +98396,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96097,9 +98426,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96125,9 +98456,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96153,9 +98486,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96181,9 +98516,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96209,9 +98546,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96237,9 +98576,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96265,9 +98606,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96293,9 +98636,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96321,9 +98666,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96349,9 +98696,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96377,9 +98726,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96405,9 +98756,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96433,9 +98786,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96461,9 +98816,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96489,9 +98846,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96517,9 +98876,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96545,9 +98906,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96573,9 +98936,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96601,9 +98966,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96629,9 +98996,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96657,9 +99026,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96685,9 +99056,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96713,9 +99086,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96741,9 +99116,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96769,9 +99146,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96797,9 +99176,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96825,9 +99206,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96853,9 +99236,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96881,9 +99266,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96909,9 +99296,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96937,9 +99326,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96965,9 +99356,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -96993,9 +99386,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97021,9 +99416,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97049,9 +99446,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97077,9 +99476,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97105,9 +99506,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97133,9 +99536,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97161,9 +99566,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97189,9 +99596,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97217,9 +99626,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97245,9 +99656,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97273,9 +99686,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97301,9 +99716,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97329,9 +99746,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97357,9 +99776,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97385,9 +99806,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97413,9 +99836,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97441,9 +99866,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97469,9 +99896,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97497,9 +99926,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97525,9 +99956,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97553,9 +99986,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97581,9 +100016,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97609,9 +100046,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97637,9 +100076,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97665,9 +100106,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97693,9 +100136,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97721,9 +100166,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97749,9 +100196,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97777,9 +100226,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97805,9 +100256,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97833,9 +100286,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97861,9 +100316,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97889,9 +100346,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97917,9 +100376,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97945,9 +100406,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -97973,9 +100436,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98001,9 +100466,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98029,9 +100496,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98057,9 +100526,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98085,9 +100556,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98113,9 +100586,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98141,9 +100616,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98169,9 +100646,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98197,9 +100676,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98225,9 +100706,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98253,9 +100736,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98281,9 +100766,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98309,9 +100796,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98337,9 +100826,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98365,9 +100856,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98393,9 +100886,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98421,9 +100916,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98449,9 +100946,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98477,9 +100976,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98505,9 +101006,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98533,9 +101036,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98561,9 +101066,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98589,9 +101096,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98617,9 +101126,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98645,9 +101156,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98673,9 +101186,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98701,9 +101216,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98729,9 +101246,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98757,9 +101276,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98785,9 +101306,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98813,9 +101336,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98841,9 +101366,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98869,9 +101396,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98897,9 +101426,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98925,9 +101456,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98953,9 +101486,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -98981,9 +101516,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99009,9 +101546,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99037,9 +101576,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99065,9 +101606,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99093,9 +101636,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99121,9 +101666,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99149,9 +101696,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99177,9 +101726,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99205,9 +101756,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99233,9 +101786,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99261,9 +101816,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99289,9 +101846,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99317,9 +101876,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99345,9 +101906,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99373,9 +101936,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99401,9 +101966,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -99429,9 +101996,11 @@ T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
 T1088,No,-,9
 T1590.002,No,-,9
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,4
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,4
 T1099,No,-,9
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
@@ -109366,10 +111935,11 @@ T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections
 T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109407,10 +111977,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109448,10 +112019,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109489,10 +112061,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109530,10 +112103,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109571,10 +112145,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109612,10 +112187,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109653,10 +112229,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109694,10 +112271,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109735,10 +112313,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109776,10 +112355,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109817,10 +112397,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109858,10 +112439,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109899,10 +112481,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109940,10 +112523,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -109981,10 +112565,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110022,10 +112607,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110063,10 +112649,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110104,10 +112691,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110145,10 +112733,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110186,10 +112775,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110227,10 +112817,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110268,10 +112859,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110309,10 +112901,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110350,10 +112943,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110391,10 +112985,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110432,10 +113027,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110473,10 +113069,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110514,10 +113111,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110555,10 +113153,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110596,10 +113195,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110637,10 +113237,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110678,10 +113279,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110719,10 +113321,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110760,10 +113363,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110801,10 +113405,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110842,10 +113447,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110883,10 +113489,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110924,10 +113531,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -110965,10 +113573,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111006,10 +113615,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111047,10 +113657,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111088,10 +113699,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111129,10 +113741,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111170,10 +113783,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111211,10 +113825,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111252,10 +113867,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111293,10 +113909,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111334,10 +113951,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111375,10 +113993,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111416,10 +114035,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111457,10 +114077,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111498,10 +114119,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111539,10 +114161,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111580,10 +114203,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111621,10 +114245,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111662,10 +114287,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111703,10 +114329,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111744,10 +114371,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111785,10 +114413,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111826,10 +114455,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111867,10 +114497,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111908,10 +114539,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111949,10 +114581,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -111990,10 +114623,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112031,10 +114665,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112072,10 +114707,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112113,10 +114749,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112154,10 +114791,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112195,10 +114833,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112236,10 +114875,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112277,10 +114917,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112318,10 +114959,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112359,10 +115001,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112400,10 +115043,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112441,10 +115085,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112482,10 +115127,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112523,10 +115169,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112564,10 +115211,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112605,10 +115253,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112646,10 +115295,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112687,10 +115337,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112728,10 +115379,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112769,10 +115421,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112810,10 +115463,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112851,10 +115505,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112892,10 +115547,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112933,10 +115589,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -112974,10 +115631,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113015,10 +115673,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113056,10 +115715,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113097,10 +115757,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113138,10 +115799,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113179,10 +115841,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113220,10 +115883,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113261,10 +115925,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113302,10 +115967,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113343,10 +116009,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113384,10 +116051,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113425,10 +116093,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113466,10 +116135,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113507,10 +116177,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113548,10 +116219,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113589,10 +116261,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113630,10 +116303,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113671,10 +116345,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113712,10 +116387,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113753,10 +116429,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113794,10 +116471,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113835,10 +116513,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113876,10 +116555,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113917,10 +116597,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113958,10 +116639,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -113999,10 +116681,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114040,10 +116723,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114081,10 +116765,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114122,10 +116807,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114163,10 +116849,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114204,10 +116891,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114245,10 +116933,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114286,10 +116975,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114327,10 +117017,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114368,10 +117059,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114409,10 +117101,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114450,10 +117143,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114491,10 +117185,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114532,10 +117227,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114573,10 +117269,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114614,10 +117311,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114655,10 +117353,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114696,10 +117395,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114737,10 +117437,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114778,10 +117479,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114819,10 +117521,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114860,10 +117563,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114901,10 +117605,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114942,10 +117647,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -114983,10 +117689,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115024,10 +117731,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115065,10 +117773,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115106,10 +117815,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115147,10 +117857,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115188,10 +117899,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115229,10 +117941,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115270,10 +117983,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115311,10 +118025,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115352,10 +118067,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115393,10 +118109,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115434,10 +118151,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115475,10 +118193,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115516,10 +118235,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115557,10 +118277,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115598,10 +118319,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115639,10 +118361,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115680,10 +118403,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115721,10 +118445,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115762,10 +118487,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115803,10 +118529,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115844,10 +118571,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115885,10 +118613,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115926,10 +118655,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -115967,10 +118697,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116008,10 +118739,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116049,10 +118781,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116090,10 +118823,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116131,10 +118865,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116172,10 +118907,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116213,10 +118949,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116254,10 +118991,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116295,10 +119033,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116336,10 +119075,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116377,10 +119117,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116418,10 +119159,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116459,10 +119201,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116500,10 +119243,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116541,10 +119285,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116582,10 +119327,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116623,10 +119369,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116664,10 +119411,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116705,10 +119453,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116746,10 +119495,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116787,10 +119537,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116828,10 +119579,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116869,10 +119621,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116910,10 +119663,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116951,10 +119705,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -116992,10 +119747,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117033,10 +119789,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117074,10 +119831,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117115,10 +119873,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117156,10 +119915,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117197,10 +119957,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117238,10 +119999,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117279,10 +120041,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117320,10 +120083,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117361,10 +120125,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117402,10 +120167,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117443,10 +120209,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117484,10 +120251,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117525,10 +120293,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117566,10 +120335,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117607,10 +120377,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117648,10 +120419,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117689,10 +120461,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117730,10 +120503,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117771,10 +120545,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117812,10 +120587,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117853,10 +120629,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117894,10 +120671,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117935,10 +120713,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -117976,10 +120755,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118017,10 +120797,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118058,10 +120839,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118099,10 +120881,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118140,10 +120923,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118181,10 +120965,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118222,10 +121007,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118263,10 +121049,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118304,10 +121091,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118345,10 +121133,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118386,10 +121175,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118427,10 +121217,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118468,10 +121259,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118509,10 +121301,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118550,10 +121343,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118591,10 +121385,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118632,10 +121427,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118673,10 +121469,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118714,10 +121511,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118755,10 +121553,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118796,10 +121595,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118837,10 +121637,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118878,10 +121679,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118919,10 +121721,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -118960,10 +121763,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119001,10 +121805,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119042,10 +121847,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119083,10 +121889,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119124,10 +121931,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119165,10 +121973,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119206,10 +122015,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119247,10 +122057,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119288,10 +122099,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119329,10 +122141,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119370,10 +122183,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119411,10 +122225,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119452,10 +122267,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119493,10 +122309,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119534,10 +122351,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119575,10 +122393,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119616,10 +122435,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119657,10 +122477,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119698,10 +122519,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119739,10 +122561,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119780,10 +122603,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119821,10 +122645,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119862,10 +122687,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119903,10 +122729,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119944,10 +122771,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -119985,10 +122813,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120026,10 +122855,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120067,10 +122897,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120108,10 +122939,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120149,10 +122981,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120190,10 +123023,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120231,10 +123065,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120272,10 +123107,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120313,10 +123149,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120354,10 +123191,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120395,10 +123233,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120436,10 +123275,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120477,10 +123317,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120518,10 +123359,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120559,10 +123401,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120600,10 +123443,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120641,10 +123485,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120682,10 +123527,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120723,10 +123569,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120764,10 +123611,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120805,10 +123653,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120846,10 +123695,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120887,10 +123737,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120928,10 +123779,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -120969,10 +123821,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121010,10 +123863,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121051,10 +123905,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121092,10 +123947,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121133,10 +123989,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121174,10 +124031,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121215,10 +124073,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121256,10 +124115,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121297,10 +124157,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121338,10 +124199,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121379,10 +124241,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121420,10 +124283,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121461,10 +124325,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121502,10 +124367,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121543,10 +124409,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121584,10 +124451,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121625,10 +124493,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121666,10 +124535,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121707,10 +124577,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121748,10 +124619,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121789,10 +124661,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121830,10 +124703,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121871,10 +124745,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121912,10 +124787,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121953,10 +124829,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -121994,10 +124871,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122035,10 +124913,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122076,10 +124955,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122117,10 +124997,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122158,10 +125039,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122199,10 +125081,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122240,10 +125123,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122281,10 +125165,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122322,10 +125207,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122363,10 +125249,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122404,10 +125291,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122445,10 +125333,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122486,10 +125375,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122527,10 +125417,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122568,10 +125459,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122609,10 +125501,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122650,10 +125543,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122691,10 +125585,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122732,10 +125627,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122773,10 +125669,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122814,10 +125711,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122855,10 +125753,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122896,10 +125795,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122937,10 +125837,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -122978,10 +125879,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123019,10 +125921,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123060,10 +125963,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123101,10 +126005,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123142,10 +126047,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123183,10 +126089,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123224,10 +126131,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123265,10 +126173,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123306,10 +126215,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123347,10 +126257,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123388,10 +126299,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123429,10 +126341,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123470,10 +126383,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123511,10 +126425,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123552,10 +126467,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123593,10 +126509,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123634,10 +126551,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123675,10 +126593,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123716,10 +126635,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123757,10 +126677,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123798,10 +126719,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123839,10 +126761,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123880,10 +126803,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123921,10 +126845,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -123962,10 +126887,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -124003,10 +126929,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -124044,10 +126971,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -124085,10 +127013,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -124126,10 +127055,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -124167,10 +127097,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -124208,10 +127139,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -124249,10 +127181,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -124290,10 +127223,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -124331,10 +127265,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -124372,10 +127307,11 @@ T1084,No,-,7
 T1001.002,No,-,7
 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
 T1069,No,-,7
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,2
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,2
 T1071,No,-,7
 T1547.009,No,-,7
 T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
@@ -124420,14 +127356,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124447,14 +127391,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124474,14 +127426,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124501,14 +127461,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124528,14 +127496,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124555,14 +127531,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124582,14 +127566,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124609,14 +127601,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124636,14 +127636,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124663,14 +127671,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124690,14 +127706,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124717,14 +127741,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124744,14 +127776,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124771,14 +127811,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124798,14 +127846,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124825,14 +127881,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124852,14 +127916,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124879,14 +127951,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124906,14 +127986,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124933,14 +128021,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124960,14 +128056,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -124987,14 +128091,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125014,14 +128126,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125041,14 +128161,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125068,14 +128196,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125095,14 +128231,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125122,14 +128266,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125149,14 +128301,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125176,14 +128336,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125203,14 +128371,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125230,14 +128406,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125257,14 +128441,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125284,14 +128476,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125311,14 +128511,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125338,14 +128546,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125365,14 +128581,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125392,14 +128616,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125419,14 +128651,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125446,14 +128686,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125473,14 +128721,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125500,14 +128756,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125527,14 +128791,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125554,14 +128826,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125581,14 +128861,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125608,14 +128896,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125635,14 +128931,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125662,14 +128966,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125689,14 +129001,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125716,14 +129036,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125743,14 +129071,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125770,14 +129106,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125797,14 +129141,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125824,14 +129176,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125851,14 +129211,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125878,14 +129246,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125905,14 +129281,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125932,14 +129316,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125959,14 +129351,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -125986,14 +129386,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126013,14 +129421,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126040,14 +129456,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126067,14 +129491,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126094,14 +129526,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126121,14 +129561,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126148,14 +129596,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126175,14 +129631,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126202,14 +129666,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126229,14 +129701,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126256,14 +129736,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126283,14 +129771,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126310,14 +129806,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126337,14 +129841,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126364,14 +129876,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126391,14 +129911,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126418,14 +129946,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126445,14 +129981,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126472,14 +130016,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126499,14 +130051,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126526,14 +130086,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126553,14 +130121,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126580,14 +130156,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126607,14 +130191,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126634,14 +130226,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126661,14 +130261,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126688,14 +130296,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126715,14 +130331,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126742,14 +130366,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126769,14 +130401,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126796,14 +130436,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126823,14 +130471,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126850,14 +130506,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126877,14 +130541,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126904,14 +130576,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126931,14 +130611,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126958,14 +130646,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -126985,14 +130681,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127012,14 +130716,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127039,14 +130751,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127066,14 +130786,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127093,14 +130821,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127120,14 +130856,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127147,14 +130891,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127174,14 +130926,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127201,14 +130961,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127228,14 +130996,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127255,14 +131031,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127282,14 +131066,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127309,14 +131101,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127336,14 +131136,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127363,14 +131171,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127390,14 +131206,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127417,14 +131241,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127444,14 +131276,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127471,14 +131311,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127498,14 +131346,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127525,14 +131381,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127552,14 +131416,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127579,14 +131451,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127606,14 +131486,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127633,14 +131521,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127660,14 +131556,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127687,14 +131591,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127714,14 +131626,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127741,14 +131661,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127768,14 +131696,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127795,14 +131731,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127822,14 +131766,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127849,14 +131801,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127876,14 +131836,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127903,14 +131871,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127930,14 +131906,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127957,14 +131941,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -127984,14 +131976,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128011,14 +132011,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128038,14 +132046,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128065,14 +132081,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128092,14 +132116,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128119,14 +132151,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128146,14 +132186,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128173,14 +132221,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128200,14 +132256,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128227,14 +132291,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128254,14 +132326,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128281,14 +132361,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128308,14 +132396,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128335,14 +132431,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128362,14 +132466,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128389,14 +132501,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128416,14 +132536,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128443,14 +132571,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128470,14 +132606,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128497,14 +132641,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128524,14 +132676,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128551,14 +132711,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128578,14 +132746,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128605,14 +132781,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128632,14 +132816,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128659,14 +132851,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128686,14 +132886,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128713,14 +132921,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128740,14 +132956,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128767,14 +132991,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128794,14 +133026,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128821,14 +133061,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128848,14 +133096,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128875,14 +133131,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128902,14 +133166,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128929,14 +133201,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128956,14 +133236,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -128983,14 +133271,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129010,14 +133306,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129037,14 +133341,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129064,14 +133376,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129091,14 +133411,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129118,14 +133446,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129145,14 +133481,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129172,14 +133516,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129199,14 +133551,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129226,14 +133586,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129253,14 +133621,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129280,14 +133656,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129307,14 +133691,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129334,14 +133726,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129361,14 +133761,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129388,14 +133796,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129415,14 +133831,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129442,14 +133866,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129469,14 +133901,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129496,14 +133936,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129523,14 +133971,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129550,14 +134006,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129577,14 +134041,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129604,14 +134076,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129631,14 +134111,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129658,14 +134146,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129685,14 +134181,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129712,14 +134216,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129739,14 +134251,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129766,14 +134286,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129793,14 +134321,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129820,14 +134356,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129847,14 +134391,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129874,14 +134426,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129901,14 +134461,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129928,14 +134496,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129955,14 +134531,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -129982,14 +134566,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130009,14 +134601,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130036,14 +134636,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130063,14 +134671,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130090,14 +134706,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130117,14 +134741,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130144,14 +134776,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130171,14 +134811,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130198,14 +134846,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130225,14 +134881,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130252,14 +134916,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130279,14 +134951,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130306,14 +134986,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130333,14 +135021,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130360,14 +135056,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130387,14 +135091,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130414,14 +135126,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130441,14 +135161,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130468,14 +135196,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130495,14 +135231,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130522,14 +135266,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130549,14 +135301,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130576,14 +135336,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130603,14 +135371,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130630,14 +135406,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130657,14 +135441,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130684,14 +135476,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130711,14 +135511,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130738,14 +135546,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130765,14 +135581,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130792,14 +135616,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130819,14 +135651,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130846,14 +135686,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130873,14 +135721,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130900,14 +135756,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130927,14 +135791,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130954,14 +135826,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -130981,14 +135861,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131008,14 +135896,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131035,14 +135931,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131062,14 +135966,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131089,14 +136001,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131116,14 +136036,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131143,14 +136071,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131170,14 +136106,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131197,14 +136141,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131224,14 +136176,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131251,14 +136211,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131278,14 +136246,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131305,14 +136281,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131332,14 +136316,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131359,14 +136351,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131386,14 +136386,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131413,14 +136421,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131440,14 +136456,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131467,14 +136491,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131494,14 +136526,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131521,14 +136561,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131548,14 +136596,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131575,14 +136631,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131602,14 +136666,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131629,14 +136701,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131656,14 +136736,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131683,14 +136771,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131710,14 +136806,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131737,14 +136841,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131764,14 +136876,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131791,14 +136911,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131818,14 +136946,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131845,14 +136981,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131872,14 +137016,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131899,14 +137051,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131926,14 +137086,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131953,14 +137121,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -131980,14 +137156,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132007,14 +137191,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132034,14 +137226,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132061,14 +137261,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132088,14 +137296,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132115,14 +137331,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132142,14 +137366,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132169,14 +137401,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132196,14 +137436,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132223,14 +137471,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132250,14 +137506,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132277,14 +137541,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132304,14 +137576,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132331,14 +137611,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132358,14 +137646,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132385,14 +137681,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132412,14 +137716,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132439,14 +137751,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132466,14 +137786,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132493,14 +137821,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132520,14 +137856,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132547,14 +137891,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132574,14 +137926,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132601,14 +137961,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132628,14 +137996,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132655,14 +138031,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132682,14 +138066,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132709,14 +138101,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132736,14 +138136,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132763,14 +138171,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132790,14 +138206,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132817,14 +138241,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132844,14 +138276,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132871,14 +138311,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132898,14 +138346,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132925,14 +138381,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132952,14 +138416,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -132979,14 +138451,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133006,14 +138486,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133033,14 +138521,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133060,14 +138556,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133087,14 +138591,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133114,14 +138626,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133141,14 +138661,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133168,14 +138696,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133195,14 +138731,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133222,14 +138766,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133249,14 +138801,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133276,14 +138836,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133303,14 +138871,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133330,14 +138906,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133357,14 +138941,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133384,14 +138976,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133411,14 +139011,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133438,14 +139046,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133465,14 +139081,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133492,14 +139116,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133519,14 +139151,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133546,14 +139186,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133573,14 +139221,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133600,14 +139256,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133627,14 +139291,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133654,14 +139326,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133681,14 +139361,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133708,14 +139396,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133735,14 +139431,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133762,14 +139466,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133789,14 +139501,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133816,14 +139536,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133843,14 +139571,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133870,14 +139606,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133897,14 +139641,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133924,14 +139676,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133951,14 +139711,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -133978,14 +139746,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -134005,14 +139781,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -134032,14 +139816,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -134059,14 +139851,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -134086,14 +139886,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -134113,14 +139921,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -134140,14 +139956,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -134167,14 +139991,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -134194,14 +140026,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -134221,14 +140061,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -134248,14 +140096,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -134275,14 +140131,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -134302,14 +140166,22 @@ T1586.002,No,-,6
 T1038,No,-,6
 T1550,No,-,6
 T1585.002,No,-,6
-T1110.003,No,-,6
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,-2
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,-2
 T1589.002,No,-,6
 T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
 T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
-T1020,No,-,6
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,4
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,4
 T1015,No,-,6
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
@@ -158575,890 +164447,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
-T1027.004,No,-,3
-T1500,No,-,3
-T1555.004,No,-,3
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
-T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
-T1498,No,-,3
-T1098.002,No,-,3
-T1588.003,No,-,3
-T1003.006,No,-,3
-T1053.002,No,-,3
-T1529,No,-,3
-T1067,No,-,3
-T1557,No,-,3
-T1213.002,No,-,3
-T1016.001,No,-,3
-T1542.003,No,-,3
-T1025,No,-,3
-T1114.001,No,-,3
-T1080,No,-,3
-T1497.001,No,-,3
-T1115,No,-,3
-T1587.002,No,-,3
-T1584.003,No,-,3
-T1567,No,-,3
-T1562.002,No,-,3
-T1004,No,-,3
-T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
-T1547.004,No,-,3
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
-T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
-T1583.003,No,-,3
-T1550.003,No,-,3
-T1074,No,-,3
-T1104,No,-,3
-T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
-T1593,No,-,3
-T1097,No,-,3
-T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
-T1573,No,-,3
-T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -159506,8 +164496,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -159555,8 +164545,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -159604,8 +164594,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -159653,8 +164643,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -159702,8 +164692,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -159751,8 +164741,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -159800,8 +164790,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -159849,8 +164888,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -159898,8 +164986,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -159947,8 +165084,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -159996,8 +165182,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160045,8 +165280,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160094,8 +165329,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160143,8 +165378,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160192,8 +165427,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160241,8 +165476,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160290,8 +165525,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160339,8 +165574,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160388,8 +165672,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160437,8 +165770,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160486,8 +165868,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160535,8 +165966,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160584,8 +166064,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160633,8 +166113,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160682,8 +166162,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160731,8 +166211,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160780,8 +166260,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160829,8 +166309,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160878,8 +166358,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160927,8 +166456,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -160976,8 +166554,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161025,8 +166652,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161074,8 +166750,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161123,8 +166848,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161172,8 +166897,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161221,8 +166946,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161270,8 +166995,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161319,8 +167044,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161368,8 +167093,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161417,8 +167142,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161466,8 +167191,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161515,8 +167240,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161564,8 +167289,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161613,8 +167338,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161662,8 +167387,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161711,8 +167436,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161760,8 +167485,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161809,8 +167534,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161858,8 +167583,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161907,8 +167632,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -161956,8 +167681,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162005,8 +167730,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162054,8 +167779,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162103,8 +167828,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162152,8 +167877,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162201,8 +167926,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162250,8 +167975,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162299,8 +168024,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162348,8 +168073,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162397,8 +168122,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162446,8 +168171,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162495,8 +168220,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162544,8 +168269,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162593,8 +168318,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162642,8 +168367,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162691,8 +168416,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162740,8 +168465,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162789,8 +168514,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162838,8 +168563,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162887,8 +168612,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162936,8 +168661,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -162985,8 +168710,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163034,8 +168759,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163083,8 +168808,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163132,8 +168857,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163181,8 +168906,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163230,8 +168955,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163279,8 +169004,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163328,8 +169053,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163377,8 +169102,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163426,8 +169151,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163475,8 +169200,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163524,8 +169249,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163573,8 +169298,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163622,8 +169347,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163671,8 +169396,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163720,8 +169445,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163769,8 +169494,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163818,8 +169543,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163867,8 +169592,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163916,8 +169641,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -163965,8 +169690,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164014,8 +169739,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164063,8 +169788,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164112,8 +169837,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164161,8 +169886,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164210,8 +169935,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164259,8 +169984,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164308,8 +170033,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164357,8 +170082,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164406,8 +170131,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164455,8 +170180,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164504,8 +170229,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164553,8 +170278,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164602,8 +170327,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164651,8 +170376,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164700,8 +170425,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164749,8 +170474,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164798,8 +170523,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164847,8 +170572,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164896,8 +170621,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164945,8 +170670,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -164994,8 +170719,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165043,8 +170768,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165092,8 +170817,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165141,8 +170866,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165190,8 +170915,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165239,8 +170964,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165288,8 +171013,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165337,8 +171062,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165386,8 +171111,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165435,8 +171160,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165484,8 +171209,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165533,8 +171258,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165582,8 +171307,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165631,8 +171356,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165680,8 +171405,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165729,8 +171454,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165778,8 +171503,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165827,8 +171552,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165876,8 +171601,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165925,8 +171650,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -165974,8 +171699,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166023,8 +171748,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166072,8 +171797,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166121,8 +171846,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166170,8 +171895,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166219,8 +171944,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166268,8 +172042,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166317,8 +172091,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166366,8 +172140,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166415,8 +172189,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166464,8 +172238,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166513,8 +172287,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166562,8 +172336,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166611,8 +172385,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166660,8 +172434,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166709,8 +172483,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166758,8 +172532,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166807,8 +172581,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166856,8 +172630,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166905,8 +172679,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -166954,8 +172728,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167003,8 +172777,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167052,8 +172826,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167101,8 +172875,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167150,8 +172924,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167199,8 +172973,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167248,8 +173022,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167297,8 +173071,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167346,8 +173120,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167395,8 +173169,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167444,8 +173218,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167493,8 +173267,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167542,8 +173316,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167591,8 +173365,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167640,8 +173414,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167689,8 +173463,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167738,8 +173512,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167787,8 +173561,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167836,8 +173610,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167885,8 +173659,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167934,8 +173708,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -167983,8 +173757,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168032,8 +173806,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168081,8 +173855,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168130,8 +173904,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168179,8 +173953,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168228,8 +174002,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168277,8 +174051,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168326,8 +174100,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168375,8 +174149,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168424,8 +174198,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168473,8 +174247,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168522,8 +174296,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168571,8 +174345,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168620,8 +174394,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168669,8 +174443,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168718,8 +174492,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168767,8 +174541,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168816,8 +174590,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168865,8 +174639,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168914,8 +174688,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -168963,8 +174737,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169012,8 +174786,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169061,8 +174835,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169110,8 +174884,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169159,8 +174933,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169208,8 +174982,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169257,8 +175031,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169306,8 +175080,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169355,8 +175129,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169404,8 +175178,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169453,8 +175227,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169502,8 +175276,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169551,8 +175325,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169600,8 +175374,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169649,8 +175423,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169698,8 +175472,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169747,8 +175521,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169796,8 +175570,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169845,8 +175619,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169894,8 +175668,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169943,8 +175717,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -169992,8 +175766,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170041,8 +175815,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170090,8 +175864,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170139,8 +175913,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170188,8 +175962,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170237,8 +176011,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170286,8 +176060,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170335,8 +176109,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170384,8 +176158,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170433,8 +176207,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170482,8 +176256,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170531,8 +176305,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170580,8 +176354,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170629,8 +176403,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170678,8 +176452,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170727,8 +176501,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170776,8 +176550,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170825,8 +176599,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170874,8 +176648,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170923,8 +176697,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -170972,8 +176746,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171021,8 +176795,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171070,8 +176844,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171119,8 +176893,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171168,8 +176942,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171217,8 +176991,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171266,8 +177040,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171315,8 +177089,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171364,8 +177138,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171413,8 +177236,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171462,8 +177285,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171511,8 +177334,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171560,8 +177383,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171609,8 +177432,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171658,8 +177481,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171707,8 +177530,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171756,8 +177579,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171805,8 +177628,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171854,8 +177677,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171903,8 +177726,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -171952,8 +177775,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172001,8 +177824,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172050,8 +177873,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172099,8 +177922,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172148,8 +177971,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172197,8 +178020,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172246,8 +178069,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172295,8 +178118,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172344,8 +178167,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172393,8 +178216,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172442,8 +178265,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172491,8 +178314,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172540,8 +178363,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172589,8 +178412,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172638,8 +178461,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172687,8 +178510,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172736,8 +178559,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172785,8 +178608,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172834,8 +178657,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172883,8 +178706,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172932,8 +178755,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -172981,8 +178804,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173030,8 +178853,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173079,8 +178902,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173128,8 +178951,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173177,8 +179000,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173226,8 +179049,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173275,8 +179098,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173324,8 +179147,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173373,8 +179196,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173422,8 +179245,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173471,8 +179294,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173520,8 +179343,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173569,8 +179392,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173618,8 +179441,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173667,8 +179490,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173716,8 +179539,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173765,8 +179588,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173814,8 +179637,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173863,8 +179686,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173912,8 +179735,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -173961,8 +179784,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174010,8 +179833,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174059,8 +179882,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174108,8 +179931,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174157,8 +179980,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174206,8 +180029,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174255,8 +180078,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174304,8 +180127,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174353,8 +180176,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174402,8 +180225,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174451,8 +180274,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174500,8 +180323,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174549,8 +180372,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174598,8 +180421,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174647,8 +180470,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174696,8 +180519,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174745,8 +180568,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174794,8 +180617,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174843,8 +180666,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174892,8 +180715,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174941,8 +180764,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -174990,8 +180813,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175039,8 +180862,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175088,8 +180911,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175137,8 +180960,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175186,8 +181009,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175235,8 +181058,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175284,8 +181107,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175333,8 +181156,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175382,8 +181205,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175431,8 +181254,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175480,8 +181303,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175529,8 +181352,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175578,8 +181401,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175627,8 +181450,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175676,8 +181499,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175725,8 +181548,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175774,8 +181597,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175823,8 +181646,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175872,8 +181695,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175921,8 +181744,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -175970,8 +181793,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -176019,8 +181842,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -176068,8 +181891,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -176117,8 +181940,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -176166,8 +181989,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -176215,8 +182038,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -176264,8 +182087,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -176313,8 +182136,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -176362,8 +182185,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -176411,8 +182234,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -176460,8 +182283,8 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -176509,8 +182332,57 @@ T1573,No,-,3
 T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
+T1027.004,No,-,3
+T1500,No,-,3
+T1555.004,No,-,3
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
+T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
+T1498,No,-,3
+T1098.002,No,-,3
+T1588.003,No,-,3
+T1003.006,No,-,3
+T1053.002,No,-,3
+T1529,No,-,3
+T1067,No,-,3
+T1557,No,-,3
+T1213.002,No,-,3
+T1016.001,No,-,3
+T1542.003,No,-,3
+T1025,No,-,3
+T1114.001,No,-,3
+T1080,No,-,3
+T1497.001,No,-,3
+T1115,No,-,3
+T1587.002,No,-,3
+T1584.003,No,-,3
+T1567,No,-,3
+T1562.002,No,-,3
+T1004,No,-,3
+T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
+T1547.004,No,-,3
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
+T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
+T1583.003,No,-,3
+T1550.003,No,-,3
+T1074,No,-,3
+T1104,No,-,3
+T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
+T1593,No,-,3
+T1097,No,-,3
+T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
+T1573,No,-,3
+T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
@@ -176545,7 +182417,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -176594,7 +182466,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -176643,7 +182515,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -176692,7 +182564,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -176741,7 +182613,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -176790,7 +182662,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -176839,7 +182711,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -176888,7 +182760,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -176937,7 +182809,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -176986,7 +182858,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177035,7 +182907,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177084,7 +182956,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177133,7 +183005,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177182,7 +183054,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177231,7 +183103,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177280,7 +183152,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177329,7 +183201,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177378,7 +183250,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177427,7 +183299,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177476,7 +183348,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177525,7 +183397,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177574,7 +183446,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177623,7 +183495,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177672,7 +183544,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177721,7 +183593,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177770,7 +183642,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177819,7 +183691,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177868,7 +183740,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177917,7 +183789,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -177966,7 +183838,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178015,7 +183887,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178064,7 +183936,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178113,7 +183985,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178162,7 +184034,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178211,7 +184083,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178260,7 +184132,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178309,7 +184181,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178358,7 +184230,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178407,7 +184279,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178456,7 +184328,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178505,7 +184377,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178554,7 +184426,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178603,7 +184475,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178652,7 +184524,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178701,7 +184573,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178750,7 +184622,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178799,7 +184671,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178848,7 +184720,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178897,7 +184769,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178946,7 +184818,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -178995,7 +184867,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179044,7 +184916,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179093,7 +184965,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179142,7 +185014,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179191,7 +185063,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179240,7 +185112,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179289,7 +185161,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179338,7 +185210,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179387,7 +185259,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179436,7 +185308,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179485,7 +185357,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179534,7 +185406,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179583,7 +185455,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179632,7 +185504,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179681,7 +185553,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179730,7 +185602,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179779,7 +185651,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179828,7 +185700,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179877,7 +185749,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179926,7 +185798,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -179975,7 +185847,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180024,7 +185896,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180073,7 +185945,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180122,7 +185994,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180171,7 +186043,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180220,7 +186092,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180269,7 +186141,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180318,7 +186190,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180367,7 +186239,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180416,7 +186288,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180465,7 +186337,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180514,7 +186386,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180563,7 +186435,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180612,7 +186484,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180661,7 +186533,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180710,7 +186582,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180759,7 +186631,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180808,7 +186680,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180857,7 +186729,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180906,7 +186778,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -180955,7 +186827,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181004,7 +186876,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181053,7 +186925,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181102,7 +186974,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181151,7 +187023,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181200,7 +187072,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181249,7 +187121,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181298,7 +187170,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181347,7 +187219,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181396,7 +187268,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181445,7 +187317,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181494,7 +187366,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181543,7 +187415,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181592,7 +187464,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181641,7 +187513,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181690,7 +187562,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181739,7 +187611,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181788,7 +187660,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181837,7 +187709,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181886,7 +187758,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181935,7 +187807,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -181984,7 +187856,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182033,7 +187905,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182082,7 +187954,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182131,7 +188003,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182180,7 +188052,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182229,7 +188101,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182278,7 +188150,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182327,7 +188199,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182376,7 +188248,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182425,7 +188297,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182474,7 +188346,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182523,7 +188395,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182572,7 +188444,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182621,7 +188493,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182670,7 +188542,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182719,7 +188591,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182768,7 +188640,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182817,7 +188689,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182866,7 +188738,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182915,7 +188787,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -182964,7 +188836,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183013,7 +188885,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183062,7 +188934,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183111,7 +188983,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183160,7 +189032,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183209,7 +189081,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183258,7 +189130,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183307,7 +189179,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183356,7 +189228,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183405,7 +189277,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183454,7 +189326,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183503,7 +189375,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183552,7 +189424,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183601,7 +189473,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183650,7 +189522,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183699,7 +189571,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183748,7 +189620,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183797,7 +189669,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183846,7 +189718,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183895,7 +189767,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183944,7 +189816,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -183993,7 +189865,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184042,7 +189914,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184091,7 +189963,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184140,7 +190012,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184189,7 +190061,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184238,7 +190110,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184287,7 +190159,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184336,7 +190208,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184385,7 +190257,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184434,7 +190306,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184483,7 +190355,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184532,7 +190404,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184581,7 +190453,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184630,7 +190502,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184679,7 +190551,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184728,7 +190600,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184777,7 +190649,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184826,7 +190698,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184875,7 +190747,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184924,7 +190796,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -184973,7 +190845,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185022,7 +190894,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185071,7 +190943,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185120,7 +190992,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185169,7 +191041,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185218,7 +191090,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185267,7 +191139,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185316,7 +191188,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185365,7 +191237,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185414,7 +191286,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185463,7 +191335,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185512,7 +191384,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185561,7 +191433,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185610,7 +191482,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185659,7 +191531,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185708,7 +191580,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185757,7 +191629,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185806,7 +191678,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185855,7 +191727,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185904,7 +191776,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -185953,7 +191825,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186002,7 +191874,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186051,7 +191923,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186100,7 +191972,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186149,7 +192021,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186198,7 +192070,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186247,7 +192119,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186296,7 +192168,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186345,7 +192217,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186394,7 +192266,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186443,7 +192315,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186492,7 +192364,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186541,7 +192413,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186590,7 +192462,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186639,7 +192511,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186688,7 +192560,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186737,7 +192609,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186786,7 +192658,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186835,7 +192707,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186884,7 +192756,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186933,7 +192805,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -186982,7 +192854,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187031,7 +192903,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187080,7 +192952,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187129,7 +193001,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187178,7 +193050,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187227,7 +193099,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187276,7 +193148,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187325,7 +193197,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187374,7 +193246,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187423,7 +193295,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187472,7 +193344,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187521,7 +193393,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187570,7 +193442,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187619,7 +193491,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187668,7 +193540,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187717,7 +193589,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187766,7 +193638,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187815,7 +193687,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187864,7 +193736,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187913,7 +193785,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -187962,7 +193834,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188011,7 +193883,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188060,7 +193932,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188109,7 +193981,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188158,7 +194030,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188207,7 +194079,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188256,7 +194128,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188305,7 +194177,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188354,7 +194226,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188403,7 +194275,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188452,7 +194324,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188501,7 +194373,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188550,7 +194422,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188599,7 +194471,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188648,7 +194520,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188697,7 +194569,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188746,7 +194618,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188795,7 +194667,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188844,7 +194716,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188893,7 +194765,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188942,7 +194814,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -188991,7 +194863,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189040,7 +194912,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189089,7 +194961,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189138,7 +195010,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189187,7 +195059,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189236,7 +195108,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189285,7 +195157,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189334,7 +195206,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189383,7 +195255,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189432,7 +195304,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189481,7 +195353,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189530,7 +195402,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189579,7 +195451,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189628,7 +195500,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189677,7 +195549,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189726,7 +195598,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189775,7 +195647,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189824,7 +195696,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189873,7 +195745,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189922,7 +195794,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -189971,7 +195843,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190020,7 +195892,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190069,7 +195941,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190118,7 +195990,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190167,7 +196039,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190216,7 +196088,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190265,7 +196137,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190314,7 +196186,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190363,7 +196235,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190412,7 +196284,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190461,7 +196333,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190510,7 +196382,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190559,7 +196431,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190608,7 +196480,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190657,7 +196529,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190706,7 +196578,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190755,7 +196627,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190804,7 +196676,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190853,7 +196725,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190902,7 +196774,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -190951,7 +196823,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191000,7 +196872,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191049,7 +196921,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191098,7 +196970,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191147,7 +197019,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191196,7 +197068,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191245,7 +197117,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191294,7 +197166,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191343,7 +197215,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191392,7 +197264,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191441,7 +197313,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191490,7 +197362,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191539,7 +197411,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191588,7 +197460,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191637,7 +197509,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191686,7 +197558,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191735,7 +197607,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191784,7 +197656,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191833,7 +197705,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191882,7 +197754,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191931,7 +197803,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -191980,7 +197852,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192029,7 +197901,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192078,7 +197950,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192127,7 +197999,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192176,7 +198048,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192225,7 +198097,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192274,7 +198146,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192323,7 +198195,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192372,7 +198244,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192421,7 +198293,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192470,7 +198342,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192519,7 +198391,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192568,7 +198440,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192617,7 +198489,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192666,7 +198538,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192715,7 +198587,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192764,7 +198636,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192813,7 +198685,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192862,7 +198734,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192911,7 +198783,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -192960,7 +198832,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193009,7 +198881,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193058,7 +198930,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193107,7 +198979,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193156,7 +199028,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193205,7 +199077,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193254,7 +199126,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193303,7 +199175,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193352,7 +199224,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193401,7 +199273,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193450,7 +199322,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193499,7 +199371,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193548,7 +199420,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193597,7 +199469,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193646,7 +199518,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193695,7 +199567,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193744,7 +199616,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193793,7 +199665,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193842,7 +199714,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193891,7 +199763,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193940,7 +199812,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -193989,7 +199861,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194038,7 +199910,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194087,7 +199959,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194136,7 +200008,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194185,7 +200057,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194234,7 +200106,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194283,7 +200155,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194332,7 +200204,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194381,7 +200253,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194430,7 +200302,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194479,7 +200351,7 @@ T1176,No,-,2
 T1560.002,No,-,2
 T1032,No,-,2
 T1087.003,No,-,2
-T1218.003,No,-,2
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
 T1483,No,-,2
 T1553.006,No,-,2
 T1217,No,-,2
@@ -194512,7 +200384,7 @@ T1118,No,-,2
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -194625,7 +200497,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -194738,7 +200610,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -194851,7 +200723,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -194964,7 +200836,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -195077,7 +200949,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -195190,7 +201062,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -195303,7 +201175,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -195416,7 +201288,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -195529,7 +201401,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -195642,7 +201514,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -195755,7 +201627,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -195868,7 +201740,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -195981,7 +201853,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -196094,7 +201966,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -196207,7 +202079,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -196320,7 +202192,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -196433,7 +202305,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -196546,7 +202418,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -196659,7 +202531,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -196772,7 +202644,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -196885,7 +202757,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -196998,7 +202870,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -197111,7 +202983,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -197224,7 +203096,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -197337,7 +203209,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -197450,7 +203322,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -197563,7 +203435,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -197676,7 +203548,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -197789,7 +203661,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -197902,7 +203774,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -198015,7 +203887,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -198128,7 +204000,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -198241,7 +204113,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -198354,7 +204226,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -198467,7 +204339,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -198580,7 +204452,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -198693,7 +204565,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -198806,7 +204678,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -198919,7 +204791,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -199032,7 +204904,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -199145,7 +205017,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -199258,7 +205130,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -199371,7 +205243,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -199484,7 +205356,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -199597,7 +205469,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -199710,7 +205582,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -199823,7 +205695,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -199936,7 +205808,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -200049,7 +205921,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -200162,7 +206034,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -200275,7 +206147,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -200388,7 +206260,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -200501,7 +206373,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -200614,7 +206486,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -200727,7 +206599,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -200840,7 +206712,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -200953,7 +206825,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -201066,7 +206938,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -201179,7 +207051,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -201292,7 +207164,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -201405,7 +207277,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -201518,7 +207390,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -201631,7 +207503,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -201744,7 +207616,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -201857,7 +207729,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -201970,7 +207842,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -202083,7 +207955,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -202196,7 +208068,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -202309,7 +208181,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -202422,7 +208294,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -202535,7 +208407,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -202648,7 +208520,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -202761,7 +208633,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -202874,7 +208746,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -202987,7 +208859,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -203100,7 +208972,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -203213,7 +209085,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -203326,7 +209198,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -203439,7 +209311,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -203552,7 +209424,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -203665,7 +209537,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -203778,7 +209650,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -203891,7 +209763,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -204004,7 +209876,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -204117,7 +209989,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -204230,7 +210102,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -204343,7 +210215,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -204456,7 +210328,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -204569,7 +210441,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -204682,7 +210554,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -204795,7 +210667,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -204908,7 +210780,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -205021,7 +210893,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -205134,7 +211006,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -205247,7 +211119,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -205360,7 +211232,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -205473,7 +211345,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -205586,7 +211458,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -205699,7 +211571,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -205812,7 +211684,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -205925,7 +211797,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -206038,7 +211910,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -206151,7 +212023,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -206264,7 +212136,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -206377,7 +212249,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -206490,7 +212362,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -206603,7 +212475,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -206716,7 +212588,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -206829,7 +212701,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -206942,7 +212814,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -207055,7 +212927,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -207168,7 +213040,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -207281,7 +213153,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -207394,7 +213266,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -207507,7 +213379,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -207620,7 +213492,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -207733,7 +213605,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -207846,7 +213718,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -207959,7 +213831,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -208072,7 +213944,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -208185,7 +214057,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -208298,7 +214170,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -208411,7 +214283,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -208524,7 +214396,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -208637,7 +214509,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -208750,7 +214622,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -208863,7 +214735,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -208976,7 +214848,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -209089,7 +214961,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -209202,7 +215074,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -209315,7 +215187,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -209428,7 +215300,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -209541,7 +215413,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -209654,7 +215526,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -209767,7 +215639,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -209880,7 +215752,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -209993,7 +215865,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -210106,7 +215978,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -210219,7 +216091,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -210332,7 +216204,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -210445,7 +216317,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -210558,7 +216430,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -210671,7 +216543,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -210784,7 +216656,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -210897,7 +216769,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -211010,7 +216882,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -211123,7 +216995,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -211236,7 +217108,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -211349,7 +217221,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -211462,7 +217334,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -211575,7 +217447,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -211688,7 +217560,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -211801,7 +217673,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -211914,7 +217786,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -212027,7 +217899,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -212140,7 +218012,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -212253,7 +218125,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -212366,7 +218238,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -212479,7 +218351,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -212592,7 +218464,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -212705,7 +218577,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -212818,7 +218690,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -212931,7 +218803,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -213044,7 +218916,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -213157,7 +219029,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -213270,7 +219142,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -213383,7 +219255,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -213496,7 +219368,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -213609,7 +219481,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -213722,7 +219594,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -213835,7 +219707,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -213948,7 +219820,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -214061,7 +219933,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -214174,7 +220046,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -214287,7 +220159,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -214400,7 +220272,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -214513,7 +220385,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -214626,7 +220498,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -214739,7 +220611,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -214852,7 +220724,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -214965,7 +220837,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -215078,7 +220950,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -215191,7 +221063,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -215304,7 +221176,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -215417,7 +221289,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -215530,7 +221402,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -215643,7 +221515,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -215756,7 +221628,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -215869,7 +221741,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -215982,7 +221854,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -216095,7 +221967,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -216208,7 +222080,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -216321,7 +222193,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -216434,7 +222306,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -216547,7 +222419,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -216660,7 +222532,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -216773,7 +222645,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -216886,7 +222758,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -216999,7 +222871,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -217112,7 +222984,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -217225,7 +223097,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -217338,7 +223210,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -217451,7 +223323,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -217564,7 +223436,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -217677,7 +223549,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -217790,7 +223662,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -217903,7 +223775,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -218016,7 +223888,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -218129,7 +224001,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -218242,7 +224114,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -218355,7 +224227,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -218468,7 +224340,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -218581,7 +224453,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -218694,7 +224566,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -218807,7 +224679,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -218920,7 +224792,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -219033,7 +224905,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -219146,7 +225018,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -219259,7 +225131,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -219372,7 +225244,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -219485,7 +225357,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -219598,7 +225470,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -219711,7 +225583,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -219824,7 +225696,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -219937,7 +225809,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -220050,7 +225922,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -220163,7 +226035,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -220276,7 +226148,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -220389,7 +226261,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -220502,7 +226374,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -220615,7 +226487,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -220728,7 +226600,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -220841,7 +226713,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -220954,7 +226826,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -221067,7 +226939,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -221180,7 +227052,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -221293,7 +227165,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -221406,7 +227278,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -221519,7 +227391,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -221632,7 +227504,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -221745,7 +227617,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -221858,7 +227730,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -221971,7 +227843,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -222084,7 +227956,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -222197,7 +228069,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -222310,7 +228182,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -222423,7 +228295,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -222536,7 +228408,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -222649,7 +228521,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -222762,7 +228634,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -222875,7 +228747,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -222988,7 +228860,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -223101,7 +228973,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -223214,7 +229086,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -223327,7 +229199,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -223440,7 +229312,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -223553,7 +229425,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -223666,7 +229538,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -223779,7 +229651,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -223892,7 +229764,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -224005,7 +229877,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -224118,7 +229990,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -224231,7 +230103,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -224344,7 +230216,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -224457,7 +230329,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -224570,7 +230442,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -224683,7 +230555,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -224796,7 +230668,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -224909,7 +230781,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -225022,7 +230894,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -225135,7 +231007,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -225248,7 +231120,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -225361,7 +231233,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -225474,7 +231346,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -225587,7 +231459,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -225700,7 +231572,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -225813,7 +231685,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -225926,7 +231798,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -226039,7 +231911,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -226152,7 +232024,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -226265,7 +232137,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -226378,7 +232250,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -226491,7 +232363,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -226604,7 +232476,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -226717,7 +232589,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -226830,7 +232702,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -226943,7 +232815,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -227056,7 +232928,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -227169,7 +233041,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -227282,7 +233154,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -227395,7 +233267,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -227508,7 +233380,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -227621,7 +233493,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -227734,7 +233606,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -227847,7 +233719,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -227960,7 +233832,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -228073,7 +233945,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -228186,7 +234058,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -228299,7 +234171,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -228412,7 +234284,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -228525,7 +234397,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -228638,7 +234510,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -228751,7 +234623,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -228864,7 +234736,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -228977,7 +234849,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -229090,7 +234962,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -229203,7 +235075,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -229316,7 +235188,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -229429,7 +235301,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -229542,7 +235414,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -229655,7 +235527,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -229768,7 +235640,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -229881,7 +235753,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -229994,7 +235866,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -230107,7 +235979,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -230220,7 +236092,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -230333,7 +236205,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -230446,7 +236318,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -230559,7 +236431,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -230672,7 +236544,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -230785,7 +236657,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -230898,7 +236770,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -231011,7 +236883,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -231124,7 +236996,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -231237,7 +237109,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -231350,7 +237222,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -231463,7 +237335,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -231576,7 +237448,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -231689,7 +237561,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -231802,7 +237674,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -231915,7 +237787,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -232028,7 +237900,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -232141,7 +238013,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -232254,7 +238126,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -232367,7 +238239,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -232480,7 +238352,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -232593,7 +238465,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -232706,7 +238578,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -232819,7 +238691,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -232932,7 +238804,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -233045,7 +238917,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -233158,7 +239030,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -233271,7 +239143,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -233384,7 +239256,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -233497,7 +239369,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -233610,7 +239482,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -233723,7 +239595,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -233836,7 +239708,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -233949,7 +239821,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -234062,7 +239934,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -234175,7 +240047,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -234288,7 +240160,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -234401,7 +240273,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -234514,7 +240386,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -234627,7 +240499,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -234740,7 +240612,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -234853,7 +240725,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -234966,7 +240838,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -235079,7 +240951,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -235192,7 +241064,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -235305,7 +241177,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -235418,7 +241290,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -235531,7 +241403,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -235644,7 +241516,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -235757,7 +241629,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
@@ -235870,7 +241742,7 @@ T1574.012,No,-,1
 T1110.001,No,-,1
 T1216.001,No,-,1
 T1491.002,No,-,1
-T1590.005,No,-,1
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,0
 T1546.013,No,-,1
 T1501,No,-,1
 T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
diff --git a/docs/mitre-map/detections.json b/docs/mitre-map/detections.json
index 8488d68f54..62e0f4f6f1 100644
--- a/docs/mitre-map/detections.json
+++ b/docs/mitre-map/detections.json
@@ -6,2205 +6,2205 @@
     "techniques": [
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1027",
-            "score": 64,
+            "score": 63,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml"
         },
         {
             "techniqueID": "T1204.002",
@@ -67545,9 +67545,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67572,9 +67572,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67599,9 +67599,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67626,9 +67626,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67653,9 +67653,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67680,9 +67680,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67707,9 +67707,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67734,9 +67734,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67761,9 +67761,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67788,9 +67788,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67815,9 +67815,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67842,9 +67842,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67869,9 +67869,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67896,9 +67896,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67923,9 +67923,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67950,9 +67950,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -67977,9 +67977,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68004,9 +68004,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68031,9 +68031,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68058,9 +68058,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68085,9 +68085,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68112,9 +68112,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68139,9 +68139,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68166,9 +68166,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68193,9 +68193,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68220,9 +68220,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68247,9 +68247,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68274,9 +68274,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68301,9 +68301,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68328,9 +68328,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68355,9 +68355,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68382,9 +68382,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68409,9 +68409,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68436,9 +68436,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68463,9 +68463,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68490,9 +68490,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68517,9 +68517,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68544,9 +68544,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68571,9 +68571,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68598,9 +68598,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68625,9 +68625,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68652,9 +68652,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68679,9 +68679,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68706,9 +68706,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68733,9 +68733,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68760,9 +68760,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68787,9 +68787,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68814,9 +68814,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68841,9 +68841,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68868,9 +68868,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68895,9 +68895,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68922,9 +68922,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68949,9 +68949,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -68976,9 +68976,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69003,9 +69003,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69030,9 +69030,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69057,9 +69057,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69084,9 +69084,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69111,9 +69111,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69138,9 +69138,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69165,9 +69165,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69192,9 +69192,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69219,9 +69219,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69246,9 +69246,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69273,9 +69273,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69300,9 +69300,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69327,9 +69327,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69354,9 +69354,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69381,9 +69381,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69408,9 +69408,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69435,9 +69435,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69462,9 +69462,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69489,9 +69489,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69516,9 +69516,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69543,9 +69543,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69570,9 +69570,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69597,9 +69597,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69624,9 +69624,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69651,9 +69651,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69678,9 +69678,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69705,9 +69705,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69732,9 +69732,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69759,9 +69759,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69786,9 +69786,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69813,9 +69813,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69840,9 +69840,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69867,9 +69867,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69894,9 +69894,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69921,9 +69921,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69948,9 +69948,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -69975,9 +69975,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70002,9 +70002,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70029,9 +70029,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70056,9 +70056,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70083,9 +70083,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70110,9 +70110,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70137,9 +70137,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70164,9 +70164,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70191,9 +70191,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70218,9 +70218,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70245,9 +70245,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70272,9 +70272,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70299,9 +70299,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70326,9 +70326,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70353,9 +70353,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70380,9 +70380,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70407,9 +70407,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70434,9 +70434,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70461,9 +70461,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70488,9 +70488,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70515,9 +70515,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70542,9 +70542,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70569,9 +70569,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70596,9 +70596,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70623,9 +70623,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70650,9 +70650,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70677,9 +70677,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70704,9 +70704,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70731,9 +70731,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70758,9 +70758,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70785,9 +70785,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70812,9 +70812,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70839,9 +70839,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70866,9 +70866,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70893,9 +70893,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70920,9 +70920,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70947,9 +70947,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -70974,9 +70974,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71001,9 +71001,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71028,9 +71028,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71055,9 +71055,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71082,9 +71082,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71109,9 +71109,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71136,9 +71136,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71163,9 +71163,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71190,9 +71190,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71217,9 +71217,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71244,9 +71244,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71271,9 +71271,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71298,9 +71298,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71325,9 +71325,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71352,9 +71352,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71379,9 +71379,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71406,9 +71406,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71433,9 +71433,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71460,9 +71460,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71487,9 +71487,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71514,9 +71514,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71541,9 +71541,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71568,9 +71568,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71595,9 +71595,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71622,9 +71622,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71649,9 +71649,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71676,9 +71676,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71703,9 +71703,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71730,9 +71730,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71757,9 +71757,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71784,9 +71784,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71811,9 +71811,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71838,9 +71838,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71865,9 +71865,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71892,9 +71892,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71919,9 +71919,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71946,9 +71946,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -71973,9 +71973,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72000,9 +72000,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72027,9 +72027,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72054,9 +72054,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72081,9 +72081,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72108,9 +72108,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72135,9 +72135,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72162,9 +72162,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72189,9 +72189,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72216,9 +72216,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72243,9 +72243,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72270,9 +72270,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72297,9 +72297,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72324,9 +72324,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72351,9 +72351,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72378,9 +72378,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72405,9 +72405,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72432,9 +72432,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72459,9 +72459,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72486,9 +72486,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72513,9 +72513,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72540,9 +72540,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72567,9 +72567,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72594,9 +72594,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72621,9 +72621,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72648,9 +72648,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72675,9 +72675,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72702,9 +72702,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72729,9 +72729,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72756,9 +72756,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72783,9 +72783,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72810,9 +72810,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72837,9 +72837,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72864,9 +72864,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72891,9 +72891,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72918,9 +72918,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72945,9 +72945,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72972,9 +72972,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -72999,9 +72999,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73026,9 +73026,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73053,9 +73053,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73080,9 +73080,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73107,9 +73107,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73134,9 +73134,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73161,9 +73161,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73188,9 +73188,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73215,9 +73215,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73242,9 +73242,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73269,9 +73269,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73296,9 +73296,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73323,9 +73323,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73350,9 +73350,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73377,9 +73377,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73404,9 +73404,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73431,9 +73431,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73458,9 +73458,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73485,9 +73485,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73512,9 +73512,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73539,9 +73539,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73566,9 +73566,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73593,9 +73593,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73620,9 +73620,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73647,9 +73647,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73674,9 +73674,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73701,9 +73701,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73728,9 +73728,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73755,9 +73755,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73782,9 +73782,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73809,9 +73809,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73836,9 +73836,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73863,9 +73863,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73890,9 +73890,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73917,9 +73917,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73944,9 +73944,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73971,9 +73971,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -73998,9 +73998,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74025,9 +74025,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74052,9 +74052,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74079,9 +74079,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74106,9 +74106,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74133,9 +74133,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74160,9 +74160,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74187,9 +74187,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74214,9 +74214,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74241,9 +74241,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74268,9 +74268,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74295,9 +74295,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74322,9 +74322,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74349,9 +74349,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74376,9 +74376,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74403,9 +74403,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74430,9 +74430,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74457,9 +74457,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74484,9 +74484,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74511,63 +74511,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
-        },
-        {
-            "techniqueID": "T1076",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1047",
-            "score": 17,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1056.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1055",
-            "score": 10,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
-        },
-        {
-            "techniqueID": "T1076",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1047",
-            "score": 17,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1056.001",
-            "score": 22,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74592,9 +74538,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74619,9 +74565,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74646,9 +74592,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74673,9 +74619,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74700,9 +74646,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74727,9 +74673,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74754,9 +74700,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74781,9 +74727,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74808,9 +74754,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74835,9 +74781,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74862,9 +74808,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74889,9 +74835,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74916,9 +74862,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74943,9 +74889,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74970,9 +74916,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -74997,9 +74943,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75024,9 +74970,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75051,9 +74997,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75078,9 +75024,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75105,9 +75051,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75132,9 +75078,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75159,9 +75105,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75186,9 +75132,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75213,9 +75159,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75240,9 +75186,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75267,9 +75213,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75294,9 +75240,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75321,9 +75267,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75348,9 +75294,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75375,9 +75321,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75402,9 +75348,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75429,9 +75375,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75456,9 +75402,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75483,9 +75429,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75510,9 +75456,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75537,9 +75483,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75564,9 +75510,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75591,9 +75537,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75618,9 +75564,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75645,9 +75591,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75672,9 +75618,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75699,9 +75645,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75726,9 +75672,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75753,9 +75699,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75780,9 +75726,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75807,9 +75753,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75834,9 +75780,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75861,9 +75807,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75888,9 +75834,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75915,9 +75861,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75942,9 +75888,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75969,9 +75915,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -75996,9 +75942,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76023,9 +75969,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76050,9 +75996,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76077,9 +76023,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76104,9 +76050,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76131,9 +76077,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76158,9 +76104,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76185,9 +76131,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76212,9 +76158,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76239,9 +76185,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76266,9 +76212,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76293,9 +76239,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76320,9 +76266,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76347,9 +76293,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76374,9 +76320,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76401,9 +76347,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76428,9 +76374,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76455,9 +76401,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76482,9 +76428,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76509,9 +76455,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76536,9 +76482,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76563,9 +76509,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76590,9 +76536,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76617,9 +76563,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76644,9 +76590,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76671,9 +76617,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76698,9 +76644,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76725,9 +76671,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76752,9 +76698,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76779,9 +76725,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76806,9 +76752,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76833,9 +76779,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76860,9 +76806,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76887,9 +76833,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76914,9 +76860,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76941,9 +76887,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76968,9 +76914,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -76995,9 +76941,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77022,9 +76968,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77049,9 +76995,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77076,9 +77022,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77103,9 +77049,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77130,9 +77076,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77157,9 +77103,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77184,9 +77130,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77211,9 +77157,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77238,9 +77184,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77265,9 +77211,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77292,9 +77238,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77319,9 +77265,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77346,9 +77292,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77373,9 +77319,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77400,9 +77346,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77427,9 +77373,9 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 10,
+            "score": 8,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
         },
         {
             "techniqueID": "T1076",
@@ -77442,10 +77388,64 @@
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1059",
+            "techniqueID": "T1047",
+            "score": 17,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1056.001",
+            "score": 22,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1055",
+            "score": 8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
+        },
+        {
+            "techniqueID": "T1076",
+            "score": 22,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.001",
+            "score": 22,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1047",
             "score": 17,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1056.001",
+            "score": 22,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1055",
+            "score": 8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml"
+        },
+        {
+            "techniqueID": "T1076",
+            "score": 22,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.001",
+            "score": 22,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059",
+            "score": 16,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77455,9 +77455,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77467,9 +77467,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77479,9 +77479,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77491,9 +77491,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77503,9 +77503,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77515,9 +77515,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77527,9 +77527,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77539,9 +77539,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77551,9 +77551,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77563,9 +77563,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77575,9 +77575,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77587,9 +77587,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77599,9 +77599,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77611,9 +77611,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77623,9 +77623,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77635,9 +77635,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77647,9 +77647,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77659,9 +77659,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77671,9 +77671,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77683,9 +77683,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77695,9 +77695,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77707,9 +77707,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77719,9 +77719,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77731,9 +77731,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77743,9 +77743,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77755,9 +77755,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77767,9 +77767,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77779,9 +77779,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77791,9 +77791,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77803,9 +77803,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77815,9 +77815,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77827,9 +77827,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77839,9 +77839,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77851,9 +77851,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77863,9 +77863,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77875,9 +77875,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77887,9 +77887,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77899,9 +77899,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77911,9 +77911,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77923,9 +77923,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77935,9 +77935,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77947,9 +77947,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77959,9 +77959,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77971,9 +77971,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77983,9 +77983,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -77995,9 +77995,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78007,9 +78007,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78019,9 +78019,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78031,9 +78031,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78043,9 +78043,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78055,9 +78055,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78067,9 +78067,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78079,9 +78079,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78091,9 +78091,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78103,9 +78103,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78115,9 +78115,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78127,9 +78127,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78139,9 +78139,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78151,9 +78151,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78163,9 +78163,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78175,9 +78175,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78187,9 +78187,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78199,9 +78199,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78211,9 +78211,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78223,9 +78223,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78235,9 +78235,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78247,9 +78247,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78259,9 +78259,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78271,9 +78271,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78283,9 +78283,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78295,9 +78295,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78307,9 +78307,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78319,9 +78319,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78331,9 +78331,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78343,9 +78343,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78355,9 +78355,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78367,9 +78367,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78379,9 +78379,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78391,9 +78391,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78403,9 +78403,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78415,9 +78415,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78427,9 +78427,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78439,9 +78439,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78451,9 +78451,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78463,9 +78463,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78475,9 +78475,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78487,9 +78487,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78499,9 +78499,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78511,9 +78511,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78523,9 +78523,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78535,9 +78535,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78547,9 +78547,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78559,9 +78559,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78571,9 +78571,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78583,9 +78583,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78595,9 +78595,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78607,9 +78607,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78619,9 +78619,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78631,9 +78631,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78643,9 +78643,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78655,9 +78655,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78667,9 +78667,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78679,9 +78679,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78691,9 +78691,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78703,9 +78703,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78715,9 +78715,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78727,9 +78727,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78739,9 +78739,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78751,9 +78751,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78763,9 +78763,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78775,9 +78775,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78787,9 +78787,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78799,9 +78799,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78811,9 +78811,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78823,9 +78823,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78835,9 +78835,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78847,9 +78847,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78859,9 +78859,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78871,9 +78871,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78883,9 +78883,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78895,9 +78895,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78907,9 +78907,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78919,9 +78919,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78931,9 +78931,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78943,9 +78943,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78955,9 +78955,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78967,9 +78967,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78979,9 +78979,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -78991,9 +78991,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79003,9 +79003,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79015,9 +79015,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79027,9 +79027,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79039,9 +79039,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79051,9 +79051,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79063,9 +79063,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79075,9 +79075,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79087,9 +79087,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79099,9 +79099,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79111,9 +79111,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79123,9 +79123,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79135,9 +79135,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79147,9 +79147,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79159,9 +79159,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79171,9 +79171,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79183,9 +79183,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79195,9 +79195,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79207,9 +79207,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79219,9 +79219,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79231,9 +79231,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79243,9 +79243,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79255,9 +79255,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79267,9 +79267,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79279,9 +79279,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79291,9 +79291,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79303,9 +79303,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79315,9 +79315,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79327,9 +79327,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79339,9 +79339,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79351,9 +79351,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79363,9 +79363,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79375,9 +79375,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79387,9 +79387,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79399,9 +79399,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79411,9 +79411,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79423,9 +79423,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79435,9 +79435,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79447,9 +79447,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79459,9 +79459,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79471,9 +79471,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79483,9 +79483,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79495,9 +79495,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79507,9 +79507,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79519,9 +79519,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79531,9 +79531,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79543,9 +79543,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79555,9 +79555,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79567,9 +79567,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79579,9 +79579,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79591,9 +79591,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79603,9 +79603,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79615,9 +79615,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79627,9 +79627,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79639,9 +79639,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79651,9 +79651,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79663,9 +79663,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79675,9 +79675,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79687,9 +79687,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79699,9 +79699,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79711,9 +79711,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79723,9 +79723,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79735,9 +79735,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79747,9 +79747,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79759,9 +79759,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79771,9 +79771,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79783,9 +79783,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79795,9 +79795,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79807,9 +79807,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79819,9 +79819,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79831,9 +79831,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79843,9 +79843,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79855,9 +79855,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79867,9 +79867,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79879,9 +79879,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79891,9 +79891,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79903,9 +79903,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79915,9 +79915,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79927,9 +79927,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79939,9 +79939,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79951,9 +79951,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79963,9 +79963,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79975,9 +79975,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79987,9 +79987,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -79999,9 +79999,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80011,9 +80011,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80023,9 +80023,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80035,9 +80035,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80047,9 +80047,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80059,9 +80059,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80071,9 +80071,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80083,9 +80083,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80095,9 +80095,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80107,9 +80107,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80119,9 +80119,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80131,9 +80131,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80143,9 +80143,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80155,9 +80155,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80167,9 +80167,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80179,9 +80179,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80191,9 +80191,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80203,9 +80203,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80215,9 +80215,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80227,9 +80227,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80239,9 +80239,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80251,9 +80251,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80263,9 +80263,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80275,9 +80275,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80287,9 +80287,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80299,9 +80299,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80311,9 +80311,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80323,9 +80323,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80335,9 +80335,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80347,9 +80347,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80359,9 +80359,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80371,9 +80371,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80383,9 +80383,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80395,9 +80395,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80407,9 +80407,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80419,9 +80419,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80431,9 +80431,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80443,9 +80443,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80455,9 +80455,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80467,9 +80467,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80479,9 +80479,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80491,9 +80491,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80503,9 +80503,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80515,9 +80515,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80527,9 +80527,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80539,9 +80539,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80551,9 +80551,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80563,9 +80563,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80575,9 +80575,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80587,9 +80587,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80599,9 +80599,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80611,9 +80611,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80623,9 +80623,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80635,9 +80635,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80647,9 +80647,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80659,9 +80659,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80671,9 +80671,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80683,9 +80683,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80695,9 +80695,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80707,9 +80707,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80719,9 +80719,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80731,9 +80731,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80743,9 +80743,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80755,9 +80755,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80767,9 +80767,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80779,9 +80779,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80791,9 +80791,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80803,9 +80803,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80815,9 +80815,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80827,9 +80827,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80839,9 +80839,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80851,9 +80851,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80863,9 +80863,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80875,9 +80875,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80887,9 +80887,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80899,9 +80899,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80911,9 +80911,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80923,9 +80923,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80935,9 +80935,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80947,9 +80947,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80959,9 +80959,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80971,9 +80971,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80983,9 +80983,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -80995,9 +80995,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81007,9 +81007,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81019,9 +81019,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81031,9 +81031,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81043,9 +81043,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81055,9 +81055,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81067,9 +81067,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81079,9 +81079,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81091,9 +81091,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81103,9 +81103,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81115,9 +81115,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81127,9 +81127,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81139,9 +81139,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81151,9 +81151,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81163,9 +81163,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81175,9 +81175,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81187,9 +81187,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81199,9 +81199,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81211,9 +81211,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81223,9 +81223,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81235,9 +81235,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81247,9 +81247,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81259,9 +81259,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81271,9 +81271,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81283,9 +81283,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81295,9 +81295,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81307,9 +81307,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81319,9 +81319,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81331,9 +81331,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81343,9 +81343,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81355,9 +81355,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81367,9 +81367,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81379,9 +81379,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81391,9 +81391,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81403,9 +81403,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81415,9 +81415,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81427,9 +81427,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81439,9 +81439,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81451,9 +81451,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81463,9 +81463,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81475,9 +81475,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81487,9 +81487,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81499,9 +81499,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81511,9 +81511,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81523,9 +81523,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81535,9 +81535,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81547,9 +81547,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81559,9 +81559,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81571,9 +81571,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81583,9 +81583,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81595,9 +81595,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81607,9 +81607,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81619,9 +81619,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81631,9 +81631,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81643,9 +81643,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81655,9 +81655,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81667,9 +81667,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81679,9 +81679,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81691,9 +81691,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81703,9 +81703,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81715,9 +81715,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81727,9 +81727,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81739,9 +81739,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81751,9 +81751,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81763,9 +81763,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81775,9 +81775,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81787,9 +81787,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81799,9 +81799,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81811,9 +81811,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81823,9 +81823,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -81835,9 +81835,9 @@
         },
         {
             "techniqueID": "T1059",
-            "score": 17,
+            "score": 16,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml"
         },
         {
             "techniqueID": "T1189",
@@ -109378,14 +109378,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -109432,14 +109433,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -109486,14 +109488,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -109540,14 +109543,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -109594,14 +109598,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -109648,14 +109653,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -109702,14 +109708,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -109756,14 +109763,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -109810,14 +109818,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -109864,14 +109873,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -109918,14 +109928,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -109972,14 +109983,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110026,14 +110038,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110080,14 +110093,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110134,14 +110148,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110188,14 +110203,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110242,14 +110258,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110296,14 +110313,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110350,14 +110368,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110404,14 +110423,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110458,14 +110478,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110512,14 +110533,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110566,14 +110588,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110620,14 +110643,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110674,14 +110698,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110728,14 +110753,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110782,14 +110808,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110836,14 +110863,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110890,14 +110918,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110944,14 +110973,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -110998,14 +111028,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111052,14 +111083,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111106,14 +111138,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111160,14 +111193,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111214,14 +111248,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111268,14 +111303,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111322,14 +111358,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111376,14 +111413,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111430,14 +111468,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111484,14 +111523,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111538,14 +111578,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111592,14 +111633,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111646,14 +111688,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111700,14 +111743,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111754,14 +111798,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111808,14 +111853,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111862,14 +111908,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111916,14 +111963,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -111970,14 +112018,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112024,14 +112073,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112078,14 +112128,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112132,14 +112183,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112186,14 +112238,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112240,14 +112293,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112294,14 +112348,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112348,14 +112403,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112402,14 +112458,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112456,14 +112513,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112510,14 +112568,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112564,14 +112623,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112618,14 +112678,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112672,14 +112733,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112726,14 +112788,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112780,14 +112843,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112834,14 +112898,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112888,14 +112953,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112942,14 +113008,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -112996,14 +113063,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113050,14 +113118,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113104,14 +113173,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113158,14 +113228,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113212,14 +113283,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113266,14 +113338,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113320,14 +113393,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113374,14 +113448,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113428,14 +113503,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113482,14 +113558,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113536,14 +113613,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113590,14 +113668,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113644,14 +113723,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113698,14 +113778,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113752,14 +113833,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113806,14 +113888,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113860,14 +113943,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113914,14 +113998,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -113968,14 +114053,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114022,14 +114108,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114076,14 +114163,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114130,14 +114218,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114184,14 +114273,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114238,14 +114328,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114292,14 +114383,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114346,14 +114438,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114400,14 +114493,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114454,14 +114548,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114508,14 +114603,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114562,14 +114658,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114616,14 +114713,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114670,14 +114768,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114724,14 +114823,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114778,14 +114878,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114832,14 +114933,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114886,14 +114988,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114940,14 +115043,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -114994,14 +115098,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115048,14 +115153,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115102,14 +115208,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115156,14 +115263,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115210,14 +115318,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115264,14 +115373,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115318,14 +115428,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115372,14 +115483,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115426,14 +115538,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115480,14 +115593,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115534,14 +115648,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115588,14 +115703,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115642,14 +115758,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115696,14 +115813,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115750,14 +115868,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115804,14 +115923,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115858,14 +115978,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115912,14 +116033,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -115966,14 +116088,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116020,14 +116143,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116074,14 +116198,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116128,14 +116253,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116182,14 +116308,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116236,14 +116363,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116290,14 +116418,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116344,14 +116473,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116398,14 +116528,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116452,14 +116583,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116506,14 +116638,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116560,14 +116693,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116614,14 +116748,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116668,14 +116803,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116722,14 +116858,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116776,14 +116913,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116830,14 +116968,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116884,14 +117023,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116938,14 +117078,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -116992,14 +117133,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117046,14 +117188,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117100,14 +117243,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117154,14 +117298,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117208,14 +117353,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117262,14 +117408,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117316,14 +117463,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117370,14 +117518,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117424,14 +117573,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117478,14 +117628,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117532,14 +117683,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117586,14 +117738,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117640,14 +117793,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117694,14 +117848,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117748,14 +117903,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117802,14 +117958,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117856,14 +118013,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117910,14 +118068,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -117964,14 +118123,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118018,14 +118178,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118072,14 +118233,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118126,14 +118288,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118180,14 +118343,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118234,14 +118398,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118288,14 +118453,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118342,14 +118508,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118396,14 +118563,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118450,14 +118618,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118504,14 +118673,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118558,14 +118728,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118612,14 +118783,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118666,14 +118838,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118720,14 +118893,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118774,14 +118948,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118828,14 +119003,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118882,14 +119058,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118936,14 +119113,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -118990,14 +119168,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119044,14 +119223,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119098,14 +119278,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119152,14 +119333,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119206,14 +119388,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119260,14 +119443,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119314,14 +119498,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119368,14 +119553,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119422,14 +119608,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119476,14 +119663,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119530,14 +119718,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119584,14 +119773,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119638,14 +119828,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119692,14 +119883,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119746,14 +119938,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119800,14 +119993,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119854,14 +120048,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119908,14 +120103,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -119962,14 +120158,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120016,14 +120213,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120070,14 +120268,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120124,14 +120323,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120178,14 +120378,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120232,14 +120433,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120286,14 +120488,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120340,14 +120543,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120394,14 +120598,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120448,14 +120653,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120502,14 +120708,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120556,14 +120763,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120610,14 +120818,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120664,14 +120873,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120718,14 +120928,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120772,14 +120983,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120826,14 +121038,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120880,14 +121093,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120934,14 +121148,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -120988,14 +121203,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121042,14 +121258,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121096,14 +121313,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121150,14 +121368,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121204,14 +121423,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121258,14 +121478,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121312,14 +121533,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121366,14 +121588,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121420,14 +121643,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121474,14 +121698,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121528,14 +121753,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121582,14 +121808,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121636,14 +121863,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121690,14 +121918,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121744,14 +121973,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121798,14 +122028,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121852,14 +122083,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121906,14 +122138,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -121960,14 +122193,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122014,14 +122248,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122068,14 +122303,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122122,14 +122358,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122176,14 +122413,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122230,14 +122468,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122284,14 +122523,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122338,14 +122578,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122392,14 +122633,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122446,14 +122688,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122500,14 +122743,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122554,14 +122798,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122608,14 +122853,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122662,14 +122908,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122716,14 +122963,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122770,14 +123018,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122824,14 +123073,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122878,14 +123128,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122932,14 +123183,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -122986,14 +123238,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123040,14 +123293,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123094,14 +123348,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123148,14 +123403,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123202,14 +123458,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123256,14 +123513,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123310,14 +123568,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123364,14 +123623,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123418,14 +123678,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123472,14 +123733,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123526,14 +123788,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123580,14 +123843,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123634,14 +123898,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123688,14 +123953,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123742,14 +124008,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123796,14 +124063,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123850,14 +124118,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123904,14 +124173,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -123958,14 +124228,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124012,14 +124283,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124066,14 +124338,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124120,14 +124393,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124174,14 +124448,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124228,14 +124503,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124282,14 +124558,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124336,14 +124613,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124390,14 +124668,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124444,14 +124723,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124498,14 +124778,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124552,14 +124833,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124606,14 +124888,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124660,14 +124943,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124714,14 +124998,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124768,14 +125053,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124822,14 +125108,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124876,14 +125163,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124930,14 +125218,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -124984,14 +125273,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125038,14 +125328,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125092,14 +125383,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125146,14 +125438,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125200,14 +125493,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125254,14 +125548,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125308,14 +125603,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125362,14 +125658,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125416,14 +125713,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125470,14 +125768,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125524,14 +125823,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125578,14 +125878,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125632,14 +125933,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125686,14 +125988,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125740,14 +126043,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125794,14 +126098,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125848,14 +126153,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125902,14 +126208,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -125956,14 +126263,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126010,14 +126318,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126064,14 +126373,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126118,14 +126428,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126172,14 +126483,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126226,14 +126538,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126280,14 +126593,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126334,14 +126648,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126388,14 +126703,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126442,14 +126758,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126496,14 +126813,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126550,14 +126868,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126604,14 +126923,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126658,14 +126978,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126712,14 +127033,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126766,14 +127088,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126820,14 +127143,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126874,14 +127198,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126928,14 +127253,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -126982,14 +127308,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127036,14 +127363,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127090,14 +127418,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127144,14 +127473,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127198,14 +127528,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127252,14 +127583,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127306,14 +127638,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127360,14 +127693,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127414,14 +127748,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127468,14 +127803,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127522,14 +127858,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127576,14 +127913,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127630,14 +127968,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127684,14 +128023,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127738,14 +128078,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127792,14 +128133,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127846,14 +128188,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127900,14 +128243,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -127954,14 +128298,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128008,14 +128353,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128062,14 +128408,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128116,14 +128463,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128170,14 +128518,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128224,14 +128573,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128278,14 +128628,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128332,14 +128683,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128386,14 +128738,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128440,14 +128793,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128494,14 +128848,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128548,14 +128903,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128602,14 +128958,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128656,14 +129013,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128710,14 +129068,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128764,14 +129123,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128818,14 +129178,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128872,14 +129233,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128926,14 +129288,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -128980,14 +129343,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -129034,14 +129398,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -129088,14 +129453,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -129142,14 +129508,15 @@
         },
         {
             "techniqueID": "T1087.002",
-            "score": 16,
-            "showSubtechniques": false
+            "score": 15,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml"
         },
         {
             "techniqueID": "T1021.002",
-            "score": 12,
+            "score": 11,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml"
         },
         {
             "techniqueID": "T1505.003",
@@ -144621,7 +144988,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -144647,7 +145014,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -144673,7 +145040,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -144699,7 +145066,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -144725,7 +145092,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -144751,7 +145118,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -144777,7 +145144,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -144803,7 +145170,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -144829,7 +145196,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -144855,7 +145222,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -144881,7 +145248,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -144907,7 +145274,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -144933,7 +145300,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -144959,7 +145326,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -144985,7 +145352,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145011,7 +145378,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145037,7 +145404,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145063,7 +145430,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145089,7 +145456,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145115,7 +145482,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145141,7 +145508,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145167,7 +145534,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145193,7 +145560,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145219,7 +145586,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145245,7 +145612,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145271,7 +145638,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145297,7 +145664,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145323,7 +145690,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145349,7 +145716,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145375,7 +145742,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145401,7 +145768,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145427,7 +145794,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145453,7 +145820,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145479,7 +145846,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145505,7 +145872,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145531,7 +145898,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145557,7 +145924,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145583,7 +145950,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145609,7 +145976,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145635,7 +146002,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145661,7 +146028,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145687,7 +146054,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145713,7 +146080,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145739,7 +146106,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145765,7 +146132,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145791,7 +146158,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145817,7 +146184,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145843,7 +146210,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145869,7 +146236,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145895,7 +146262,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145921,7 +146288,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145947,7 +146314,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145973,7 +146340,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -145999,7 +146366,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146025,7 +146392,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146051,7 +146418,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146077,7 +146444,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146103,7 +146470,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146129,7 +146496,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146155,7 +146522,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146181,7 +146548,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146207,7 +146574,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146233,7 +146600,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146259,7 +146626,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146285,7 +146652,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146311,7 +146678,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146337,7 +146704,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146363,7 +146730,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146389,7 +146756,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146415,7 +146782,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146441,7 +146808,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146467,7 +146834,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146493,7 +146860,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146519,7 +146886,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146545,7 +146912,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146571,7 +146938,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146597,7 +146964,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146623,7 +146990,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146649,7 +147016,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146675,7 +147042,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146701,7 +147068,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146727,7 +147094,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146753,7 +147120,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146779,7 +147146,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146805,7 +147172,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146831,7 +147198,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146857,7 +147224,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146883,7 +147250,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146909,7 +147276,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146935,7 +147302,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146961,7 +147328,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -146987,7 +147354,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147013,7 +147380,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147039,7 +147406,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147065,7 +147432,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147091,7 +147458,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147117,7 +147484,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147143,7 +147510,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147169,7 +147536,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147195,7 +147562,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147221,7 +147588,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147247,7 +147614,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147273,7 +147640,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147299,7 +147666,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147325,7 +147692,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147351,7 +147718,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147377,7 +147744,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147403,7 +147770,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147429,7 +147796,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147455,7 +147822,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147481,7 +147848,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147507,7 +147874,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147533,7 +147900,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147559,7 +147926,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147585,7 +147952,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147611,7 +147978,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147637,7 +148004,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147663,7 +148030,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147689,7 +148056,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147715,7 +148082,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147741,7 +148108,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147767,7 +148134,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147793,7 +148160,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147819,7 +148186,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147845,7 +148212,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147871,7 +148238,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147897,7 +148264,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147923,7 +148290,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147949,7 +148316,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -147975,7 +148342,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148001,7 +148368,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148027,7 +148394,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148053,7 +148420,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148079,7 +148446,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148105,7 +148472,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148131,7 +148498,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148157,7 +148524,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148183,7 +148550,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148209,7 +148576,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148235,7 +148602,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148261,7 +148628,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148287,7 +148654,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148313,7 +148680,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148339,7 +148706,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148365,7 +148732,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148391,7 +148758,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148417,7 +148784,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148443,7 +148810,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148469,7 +148836,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148495,7 +148862,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148521,7 +148888,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148547,7 +148914,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148573,7 +148940,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148599,7 +148966,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148625,7 +148992,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148651,7 +149018,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148677,7 +149044,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148703,7 +149070,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148729,7 +149096,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148755,7 +149122,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148781,7 +149148,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148807,7 +149174,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148833,7 +149200,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148859,7 +149226,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148885,7 +149252,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148911,7 +149278,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148937,7 +149304,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148963,7 +149330,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -148989,7 +149356,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149015,7 +149382,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149041,7 +149408,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149067,7 +149434,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149093,7 +149460,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149119,7 +149486,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149145,7 +149512,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149171,7 +149538,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149197,7 +149564,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149223,7 +149590,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149249,7 +149616,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149275,7 +149642,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149301,7 +149668,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149327,7 +149694,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149353,7 +149720,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149379,7 +149746,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149405,7 +149772,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149431,7 +149798,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149457,7 +149824,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149483,7 +149850,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149509,7 +149876,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149535,7 +149902,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149561,7 +149928,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149587,7 +149954,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149613,7 +149980,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149639,7 +150006,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149665,7 +150032,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149691,7 +150058,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149717,7 +150084,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149743,7 +150110,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149769,7 +150136,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149795,7 +150162,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149821,7 +150188,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149847,7 +150214,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149873,7 +150240,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149899,7 +150266,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149925,7 +150292,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149951,7 +150318,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -149977,7 +150344,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150003,7 +150370,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150029,7 +150396,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150055,7 +150422,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150081,7 +150448,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150107,7 +150474,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150133,7 +150500,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150159,7 +150526,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150185,7 +150552,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150211,7 +150578,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150237,7 +150604,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150263,7 +150630,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150289,7 +150656,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150315,7 +150682,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150341,7 +150708,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150367,7 +150734,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150393,7 +150760,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150419,7 +150786,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150445,7 +150812,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150471,7 +150838,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150497,7 +150864,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150523,7 +150890,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150549,7 +150916,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150575,7 +150942,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150601,7 +150968,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150627,7 +150994,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150653,7 +151020,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150679,7 +151046,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150705,7 +151072,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150731,7 +151098,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150757,7 +151124,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150783,7 +151150,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150809,7 +151176,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150835,7 +151202,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150861,7 +151228,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150887,7 +151254,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150913,7 +151280,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150939,7 +151306,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150965,7 +151332,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -150991,7 +151358,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151017,7 +151384,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151043,7 +151410,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151069,7 +151436,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151095,7 +151462,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151121,7 +151488,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151147,7 +151514,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151173,7 +151540,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151199,7 +151566,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151225,7 +151592,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151251,7 +151618,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151277,7 +151644,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151303,7 +151670,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151329,7 +151696,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151355,7 +151722,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151381,7 +151748,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151407,7 +151774,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151433,7 +151800,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151459,7 +151826,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151485,7 +151852,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151511,7 +151878,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151537,7 +151904,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151563,7 +151930,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151589,7 +151956,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151615,7 +151982,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151641,7 +152008,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151667,7 +152034,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151693,7 +152060,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151719,7 +152086,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151745,7 +152112,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151771,7 +152138,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151797,7 +152164,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151823,7 +152190,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151849,7 +152216,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151875,7 +152242,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151901,7 +152268,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151927,7 +152294,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151953,7 +152320,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -151979,7 +152346,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152005,7 +152372,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152031,7 +152398,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152057,7 +152424,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152083,7 +152450,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152109,7 +152476,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152135,7 +152502,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152161,7 +152528,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152187,7 +152554,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152213,7 +152580,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152239,7 +152606,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152265,7 +152632,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152291,7 +152658,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152317,7 +152684,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152343,7 +152710,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152369,7 +152736,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152395,7 +152762,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152421,7 +152788,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152447,7 +152814,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152473,7 +152840,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152499,7 +152866,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152525,7 +152892,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152551,7 +152918,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152577,7 +152944,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152603,7 +152970,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152629,7 +152996,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152655,7 +153022,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152681,7 +153048,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152707,7 +153074,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152733,7 +153100,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152759,7 +153126,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152785,7 +153152,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152811,7 +153178,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152837,7 +153204,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152863,7 +153230,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152889,7 +153256,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152915,7 +153282,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152941,7 +153308,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152967,7 +153334,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -152993,7 +153360,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153019,7 +153386,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153045,7 +153412,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153071,7 +153438,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153097,7 +153464,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153123,7 +153490,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153149,7 +153516,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153175,7 +153542,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153201,7 +153568,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153227,7 +153594,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153253,7 +153620,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153279,7 +153646,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153305,7 +153672,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153331,7 +153698,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153357,7 +153724,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153383,7 +153750,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153409,7 +153776,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153435,7 +153802,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153461,7 +153828,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153487,7 +153854,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153513,7 +153880,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153539,7 +153906,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153565,7 +153932,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153591,7 +153958,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153617,7 +153984,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153643,7 +154010,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153669,7 +154036,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153695,7 +154062,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153721,7 +154088,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153747,7 +154114,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153773,7 +154140,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153799,7 +154166,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153825,7 +154192,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153851,7 +154218,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153877,7 +154244,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153903,7 +154270,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153929,7 +154296,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153955,7 +154322,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -153981,7 +154348,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154007,7 +154374,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154033,7 +154400,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154059,7 +154426,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154085,7 +154452,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154111,7 +154478,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -154137,7 +154504,7 @@
             "techniqueID": "T1562.001",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml"
         },
         {
             "techniqueID": "T1027.002",
@@ -205164,9 +205531,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -205252,9 +205619,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -205340,9 +205707,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -205428,9 +205795,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -205516,9 +205883,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -205604,9 +205971,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -205692,9 +206059,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -205780,9 +206147,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -205868,9 +206235,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -205956,9 +206323,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -206044,9 +206411,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -206132,9 +206499,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -206220,9 +206587,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -206308,9 +206675,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -206396,9 +206763,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -206484,9 +206851,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -206572,9 +206939,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -206660,9 +207027,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -206748,9 +207115,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -206836,9 +207203,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -206924,9 +207291,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -207012,9 +207379,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -207100,9 +207467,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -207188,9 +207555,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -207276,9 +207643,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -207364,9 +207731,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -207452,9 +207819,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -207540,9 +207907,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -207628,9 +207995,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -207716,9 +208083,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -207804,9 +208171,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -207892,9 +208259,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -207980,9 +208347,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208068,9 +208435,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208156,9 +208523,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208244,9 +208611,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208332,9 +208699,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208420,9 +208787,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208508,9 +208875,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208596,9 +208963,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208684,9 +209051,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208772,9 +209139,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208860,9 +209227,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -208948,9 +209315,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209036,9 +209403,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209124,9 +209491,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209212,9 +209579,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209300,9 +209667,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209388,9 +209755,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209476,9 +209843,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209564,9 +209931,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209652,9 +210019,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209740,9 +210107,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209828,9 +210195,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -209916,9 +210283,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210004,9 +210371,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210092,9 +210459,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210180,9 +210547,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210268,9 +210635,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210356,9 +210723,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210444,9 +210811,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210532,9 +210899,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210620,9 +210987,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210708,9 +211075,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210796,9 +211163,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210884,9 +211251,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -210972,9 +211339,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211060,9 +211427,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211148,9 +211515,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211236,9 +211603,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211324,9 +211691,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211412,9 +211779,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211500,9 +211867,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211588,9 +211955,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211676,9 +212043,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211764,9 +212131,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211852,9 +212219,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -211940,9 +212307,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212028,9 +212395,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212116,9 +212483,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212204,9 +212571,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212292,9 +212659,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212380,9 +212747,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212468,9 +212835,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212556,9 +212923,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212644,9 +213011,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212732,9 +213099,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212820,9 +213187,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212908,9 +213275,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -212996,9 +213363,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213084,9 +213451,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213172,9 +213539,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213260,9 +213627,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213348,9 +213715,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213436,9 +213803,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213524,9 +213891,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213612,9 +213979,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213700,9 +214067,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213788,9 +214155,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213876,9 +214243,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -213964,9 +214331,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214052,9 +214419,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214140,9 +214507,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214228,9 +214595,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214316,9 +214683,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214404,9 +214771,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214492,9 +214859,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214580,9 +214947,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214668,9 +215035,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214756,9 +215123,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214844,9 +215211,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -214932,9 +215299,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215020,9 +215387,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215108,9 +215475,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215196,9 +215563,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215284,9 +215651,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215372,9 +215739,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215460,9 +215827,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215548,9 +215915,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215636,9 +216003,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215724,9 +216091,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215812,9 +216179,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215900,9 +216267,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -215988,9 +216355,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216076,9 +216443,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216164,9 +216531,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216252,9 +216619,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216340,9 +216707,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216428,9 +216795,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216516,9 +216883,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216604,9 +216971,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216692,9 +217059,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216780,9 +217147,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216868,9 +217235,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -216956,9 +217323,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217044,9 +217411,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217132,9 +217499,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217220,9 +217587,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217308,9 +217675,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217396,9 +217763,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217484,9 +217851,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217572,9 +217939,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217660,9 +218027,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217748,9 +218115,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217836,9 +218203,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -217924,9 +218291,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218012,9 +218379,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218100,9 +218467,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218188,9 +218555,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218276,9 +218643,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218364,9 +218731,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218452,9 +218819,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218540,9 +218907,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218628,9 +218995,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218716,9 +219083,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218804,9 +219171,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218892,9 +219259,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -218980,9 +219347,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219068,9 +219435,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219156,9 +219523,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219244,9 +219611,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219332,9 +219699,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219420,9 +219787,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219508,9 +219875,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219596,9 +219963,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219684,9 +220051,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219772,9 +220139,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219860,9 +220227,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -219948,9 +220315,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220036,9 +220403,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220124,9 +220491,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220212,9 +220579,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220300,9 +220667,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220388,9 +220755,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220476,9 +220843,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220564,9 +220931,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220652,9 +221019,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220740,9 +221107,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220828,9 +221195,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -220916,9 +221283,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221004,9 +221371,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221092,9 +221459,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221180,9 +221547,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221268,9 +221635,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221356,9 +221723,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221444,9 +221811,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221532,9 +221899,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221620,9 +221987,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221708,9 +222075,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221796,9 +222163,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221884,9 +222251,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -221972,9 +222339,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222060,9 +222427,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222148,9 +222515,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222236,9 +222603,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222324,9 +222691,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222412,9 +222779,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222500,9 +222867,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222588,9 +222955,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222676,9 +223043,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222764,9 +223131,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222852,9 +223219,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -222940,9 +223307,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223028,9 +223395,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223116,9 +223483,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223204,9 +223571,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223292,9 +223659,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223380,9 +223747,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223468,9 +223835,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223556,9 +223923,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223644,9 +224011,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223732,9 +224099,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223820,9 +224187,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223908,9 +224275,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -223996,9 +224363,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224084,9 +224451,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224172,9 +224539,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224260,9 +224627,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224348,9 +224715,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224436,9 +224803,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224524,9 +224891,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224612,9 +224979,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224700,9 +225067,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224788,9 +225155,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224876,9 +225243,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -224964,9 +225331,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225052,9 +225419,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225140,9 +225507,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225228,9 +225595,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225316,9 +225683,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225404,9 +225771,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225492,9 +225859,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225580,9 +225947,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225668,9 +226035,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225756,9 +226123,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225844,9 +226211,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -225932,9 +226299,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226020,9 +226387,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226108,9 +226475,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226196,9 +226563,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226284,9 +226651,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226372,9 +226739,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226460,9 +226827,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226548,9 +226915,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226636,9 +227003,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226724,9 +227091,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226812,9 +227179,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226900,9 +227267,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -226988,9 +227355,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227076,9 +227443,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227164,9 +227531,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227252,9 +227619,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227340,9 +227707,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227428,9 +227795,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227516,9 +227883,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227604,9 +227971,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227692,9 +228059,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227780,9 +228147,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227868,9 +228235,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -227956,9 +228323,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228044,9 +228411,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228132,9 +228499,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228220,9 +228587,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228308,9 +228675,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228396,9 +228763,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228484,9 +228851,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228572,9 +228939,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228660,9 +229027,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228748,9 +229115,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228836,9 +229203,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -228924,9 +229291,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229012,9 +229379,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229100,9 +229467,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229188,9 +229555,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229276,9 +229643,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229364,9 +229731,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229452,9 +229819,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229540,9 +229907,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229628,9 +229995,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229716,9 +230083,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229804,9 +230171,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229892,9 +230259,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -229980,9 +230347,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230068,9 +230435,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230156,9 +230523,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230244,9 +230611,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230332,9 +230699,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230420,9 +230787,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230508,9 +230875,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230596,9 +230963,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230684,9 +231051,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230772,9 +231139,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230860,9 +231227,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -230948,9 +231315,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231036,9 +231403,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231124,9 +231491,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231212,9 +231579,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231300,9 +231667,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231388,9 +231755,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231476,9 +231843,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231564,9 +231931,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231652,9 +232019,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231740,9 +232107,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231828,9 +232195,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -231916,9 +232283,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232004,9 +232371,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232092,9 +232459,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232180,9 +232547,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232268,9 +232635,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232356,9 +232723,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232444,9 +232811,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232532,9 +232899,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232620,9 +232987,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232708,9 +233075,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232796,9 +233163,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232884,9 +233251,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -232972,9 +233339,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233060,9 +233427,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233148,9 +233515,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233236,9 +233603,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233324,9 +233691,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233412,9 +233779,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233500,9 +233867,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233588,9 +233955,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233676,9 +234043,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233764,9 +234131,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233852,9 +234219,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -233940,9 +234307,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234028,9 +234395,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234116,9 +234483,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234204,9 +234571,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234292,9 +234659,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234380,9 +234747,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234468,9 +234835,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234556,9 +234923,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234644,9 +235011,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234732,9 +235099,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234820,9 +235187,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234908,9 +235275,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -234996,9 +235363,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235084,9 +235451,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235172,9 +235539,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235260,9 +235627,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235348,9 +235715,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235436,9 +235803,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235524,9 +235891,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235612,9 +235979,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235700,9 +236067,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235788,9 +236155,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235876,9 +236243,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -235964,9 +236331,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236052,9 +236419,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236140,9 +236507,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236228,9 +236595,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236316,9 +236683,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236404,9 +236771,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236492,9 +236859,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236580,9 +236947,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236668,9 +237035,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236756,9 +237123,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236844,9 +237211,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -236932,9 +237299,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237020,9 +237387,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237108,9 +237475,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237196,9 +237563,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237284,9 +237651,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -237372,9 +237739,9 @@
         },
         {
             "techniqueID": "T1548.002",
-            "score": 6,
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml"
         },
         {
             "techniqueID": "T1099",
@@ -266820,9 +267187,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -266922,9 +267289,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -267024,9 +267391,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -267126,9 +267493,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -267228,9 +267595,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -267330,9 +267697,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -267432,9 +267799,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -267534,9 +267901,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -267636,9 +268003,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -267738,9 +268105,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -267840,9 +268207,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -267942,9 +268309,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -268044,9 +268411,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -268146,9 +268513,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -268248,9 +268615,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -268350,9 +268717,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -268452,9 +268819,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -268554,9 +268921,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -268656,9 +269023,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -268758,9 +269125,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -268860,9 +269227,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -268962,9 +269329,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -269064,9 +269431,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -269166,9 +269533,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -269268,9 +269635,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -269370,9 +269737,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -269472,9 +269839,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -269574,9 +269941,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -269676,9 +270043,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -269778,9 +270145,111 @@
         },
         {
             "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+        },
+        {
+            "techniqueID": "T1071",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1547.009",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1546.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
+        },
+        {
+            "techniqueID": "T1023",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1098",
+            "score": -8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1195.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1570",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1075",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.003",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1194",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1221",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1550.002",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
+        },
+        {
+            "techniqueID": "T1084",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1566.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
+        },
+        {
+            "techniqueID": "T1069",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -269880,9 +270349,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -269982,9 +270451,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270084,9 +270553,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270186,9 +270655,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270288,9 +270757,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270390,9 +270859,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270492,9 +270961,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270594,9 +271063,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270696,9 +271165,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270798,9 +271267,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -270900,9 +271369,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271002,9 +271471,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271104,9 +271573,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271206,9 +271675,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271308,9 +271777,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271410,9 +271879,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271512,9 +271981,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271614,9 +272083,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271716,9 +272185,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271818,9 +272287,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -271920,9 +272389,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272022,9 +272491,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272124,9 +272593,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272226,9 +272695,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272328,9 +272797,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272430,9 +272899,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272532,9 +273001,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272634,9 +273103,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272736,9 +273205,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272838,9 +273307,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -272940,9 +273409,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273042,9 +273511,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273144,9 +273613,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273246,9 +273715,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273348,9 +273817,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273450,9 +273919,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273552,9 +274021,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273654,9 +274123,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273756,9 +274225,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273858,9 +274327,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -273960,9 +274429,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274062,9 +274531,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274164,9 +274633,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274266,9 +274735,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274368,9 +274837,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274470,9 +274939,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274572,9 +275041,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274674,9 +275143,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274776,9 +275245,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274878,9 +275347,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -274980,9 +275449,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275082,9 +275551,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275184,9 +275653,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275286,9 +275755,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275388,9 +275857,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275490,9 +275959,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275592,9 +276061,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275694,9 +276163,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275796,9 +276265,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -275898,9 +276367,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276000,9 +276469,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276102,9 +276571,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276204,9 +276673,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276306,9 +276775,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276408,9 +276877,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276510,9 +276979,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276612,9 +277081,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276714,9 +277183,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276816,9 +277285,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -276918,9 +277387,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277020,9 +277489,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277122,9 +277591,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277224,9 +277693,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277326,9 +277795,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277428,9 +277897,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277530,9 +277999,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277632,9 +278101,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277734,9 +278203,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277836,9 +278305,111 @@
         },
         {
             "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+        },
+        {
+            "techniqueID": "T1071",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1547.009",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1546.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
+        },
+        {
+            "techniqueID": "T1023",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1098",
+            "score": -8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1195.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1570",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1075",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.003",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1194",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1221",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1550.002",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
+        },
+        {
+            "techniqueID": "T1084",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1566.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
+        },
+        {
+            "techniqueID": "T1069",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -277938,9 +278509,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278040,9 +278611,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278142,9 +278713,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278244,9 +278815,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278346,9 +278917,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278448,9 +279019,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278550,9 +279121,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278652,9 +279223,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278754,9 +279325,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278856,9 +279427,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -278958,9 +279529,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279060,9 +279631,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279162,9 +279733,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279264,9 +279835,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279366,9 +279937,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279468,9 +280039,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279570,9 +280141,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279672,9 +280243,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279774,9 +280345,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279876,9 +280447,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -279978,9 +280549,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280080,9 +280651,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280182,9 +280753,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280284,9 +280855,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280386,9 +280957,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280488,9 +281059,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280590,9 +281161,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280692,9 +281263,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280794,9 +281365,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280896,9 +281467,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -280998,9 +281569,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281100,9 +281671,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281202,9 +281773,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281304,9 +281875,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281406,9 +281977,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281508,9 +282079,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281610,9 +282181,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281712,9 +282283,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281814,9 +282385,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -281916,9 +282487,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282018,9 +282589,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282120,9 +282691,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282222,9 +282793,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282324,9 +282895,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282426,9 +282997,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282528,9 +283099,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282630,9 +283201,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282732,9 +283303,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282834,9 +283405,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -282936,9 +283507,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283038,9 +283609,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283140,9 +283711,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283242,9 +283813,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283344,9 +283915,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283446,9 +284017,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283548,9 +284119,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283650,9 +284221,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283752,9 +284323,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283854,9 +284425,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -283956,9 +284527,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284058,9 +284629,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284160,9 +284731,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284262,9 +284833,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284364,9 +284935,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284466,9 +285037,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284568,9 +285139,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284670,9 +285241,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284772,9 +285343,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284874,9 +285445,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -284976,9 +285547,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285078,9 +285649,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285180,9 +285751,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285282,9 +285853,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285384,9 +285955,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285486,9 +286057,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285588,9 +286159,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285690,9 +286261,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285792,9 +286363,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285894,9 +286465,111 @@
         },
         {
             "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+        },
+        {
+            "techniqueID": "T1071",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1547.009",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1546.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
+        },
+        {
+            "techniqueID": "T1023",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1098",
+            "score": -8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1195.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1570",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1075",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.003",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1194",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1221",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1550.002",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
+        },
+        {
+            "techniqueID": "T1084",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1566.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
+        },
+        {
+            "techniqueID": "T1069",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -285996,9 +286669,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286098,9 +286771,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286200,9 +286873,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286302,9 +286975,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286404,9 +287077,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286506,9 +287179,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286608,9 +287281,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286710,9 +287383,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286812,9 +287485,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -286914,9 +287587,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287016,9 +287689,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287118,9 +287791,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287220,9 +287893,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287322,9 +287995,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287424,9 +288097,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287526,9 +288199,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287628,9 +288301,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287730,9 +288403,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287832,9 +288505,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -287934,9 +288607,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288036,9 +288709,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288138,9 +288811,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288240,9 +288913,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288342,9 +289015,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288444,9 +289117,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288546,9 +289219,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288648,9 +289321,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288750,9 +289423,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288852,9 +289525,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -288954,9 +289627,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289056,9 +289729,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289158,9 +289831,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289260,9 +289933,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289362,9 +290035,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289464,9 +290137,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289566,9 +290239,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289668,9 +290341,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289770,9 +290443,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289872,9 +290545,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -289974,9 +290647,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290076,9 +290749,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290178,9 +290851,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290280,9 +290953,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290382,9 +291055,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290484,9 +291157,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290586,9 +291259,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290688,9 +291361,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290790,9 +291463,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290892,9 +291565,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -290994,9 +291667,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291096,9 +291769,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291198,9 +291871,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291300,9 +291973,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291402,9 +292075,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291504,9 +292177,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291606,9 +292279,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291708,9 +292381,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291810,9 +292483,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -291912,9 +292585,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292014,9 +292687,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292116,9 +292789,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292218,9 +292891,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292320,9 +292993,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292422,9 +293095,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292524,9 +293197,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292626,9 +293299,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292728,9 +293401,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292830,9 +293503,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -292932,9 +293605,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293034,9 +293707,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293136,9 +293809,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293238,9 +293911,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293340,9 +294013,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293442,9 +294115,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293544,9 +294217,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293646,9 +294319,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293748,9 +294421,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293850,9 +294523,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -293952,9 +294625,111 @@
         },
         {
             "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+        },
+        {
+            "techniqueID": "T1071",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1547.009",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1546.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
+        },
+        {
+            "techniqueID": "T1023",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1098",
+            "score": -8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1195.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1570",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1075",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.003",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1194",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1221",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1550.002",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
+        },
+        {
+            "techniqueID": "T1084",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1566.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
+        },
+        {
+            "techniqueID": "T1069",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294054,9 +294829,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294156,9 +294931,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294258,9 +295033,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294360,9 +295135,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294462,9 +295237,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294564,9 +295339,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294666,9 +295441,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294768,9 +295543,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294870,9 +295645,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -294972,9 +295747,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295074,9 +295849,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295176,9 +295951,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295278,9 +296053,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295380,9 +296155,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295482,9 +296257,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295584,9 +296359,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295686,9 +296461,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295788,9 +296563,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295890,9 +296665,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -295992,9 +296767,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296094,9 +296869,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296196,9 +296971,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296298,9 +297073,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296400,9 +297175,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296502,9 +297277,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296604,9 +297379,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296706,9 +297481,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296808,9 +297583,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -296910,9 +297685,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297012,9 +297787,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297114,9 +297889,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297216,9 +297991,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297318,9 +298093,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297420,9 +298195,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297522,9 +298297,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297624,9 +298399,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297726,9 +298501,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297828,9 +298603,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -297930,9 +298705,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298032,9 +298807,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298134,9 +298909,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298236,9 +299011,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298338,9 +299113,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298440,9 +299215,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298542,9 +299317,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298644,9 +299419,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298746,9 +299521,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298848,9 +299623,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -298950,9 +299725,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299052,9 +299827,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299154,9 +299929,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299256,9 +300031,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299358,9 +300133,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299460,9 +300235,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299562,9 +300337,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299664,9 +300439,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299766,9 +300541,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299868,9 +300643,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -299970,9 +300745,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300072,9 +300847,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300174,9 +300949,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300276,9 +301051,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300378,9 +301153,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300480,9 +301255,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300582,9 +301357,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300684,9 +301459,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300786,9 +301561,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300888,9 +301663,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -300990,9 +301765,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301092,9 +301867,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301194,9 +301969,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301296,9 +302071,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301398,9 +302173,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301500,9 +302275,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301602,9 +302377,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301704,9 +302479,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301806,9 +302581,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -301908,9 +302683,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302010,9 +302785,111 @@
         },
         {
             "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+        },
+        {
+            "techniqueID": "T1071",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1547.009",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1546.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
+        },
+        {
+            "techniqueID": "T1023",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1098",
+            "score": -8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1195.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1570",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1075",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.003",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1194",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1221",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1550.002",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
+        },
+        {
+            "techniqueID": "T1084",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1566.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
+        },
+        {
+            "techniqueID": "T1069",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302112,9 +302989,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302214,9 +303091,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302316,9 +303193,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302418,9 +303295,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302520,9 +303397,111 @@
         },
         {
             "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+        },
+        {
+            "techniqueID": "T1071",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1547.009",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1546.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
+        },
+        {
+            "techniqueID": "T1023",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1098",
+            "score": -8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1195.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1570",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1075",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.003",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1194",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1221",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1550.002",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
+        },
+        {
+            "techniqueID": "T1084",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1566.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
+        },
+        {
+            "techniqueID": "T1069",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302622,9 +303601,111 @@
         },
         {
             "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+        },
+        {
+            "techniqueID": "T1071",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1547.009",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1546.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
+        },
+        {
+            "techniqueID": "T1023",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1098",
+            "score": -8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1195.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1570",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1075",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.003",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1194",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1221",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1550.002",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
+        },
+        {
+            "techniqueID": "T1084",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1566.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
+        },
+        {
+            "techniqueID": "T1069",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302724,9 +303805,111 @@
         },
         {
             "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+        },
+        {
+            "techniqueID": "T1071",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1547.009",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1546.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
+        },
+        {
+            "techniqueID": "T1023",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1590",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1098",
+            "score": -8,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1195.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1570",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1075",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1027.003",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1194",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1221",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
+        },
+        {
+            "techniqueID": "T1550.002",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
+        },
+        {
+            "techniqueID": "T1084",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.002",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1566.003",
+            "score": 6,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
+        },
+        {
+            "techniqueID": "T1069",
+            "score": 7,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1003.002",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302826,9 +304009,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -302928,9 +304111,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303030,9 +304213,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303132,9 +304315,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303234,9 +304417,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303336,9 +304519,9 @@
         },
         {
             "techniqueID": "T1003.002",
-            "score": 3,
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
         },
         {
             "techniqueID": "T1071",
@@ -303432,820 +304615,559 @@
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
         },
         {
-            "techniqueID": "T1069",
-            "score": 7,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.002",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
-        },
-        {
-            "techniqueID": "T1071",
-            "score": 7,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1547.009",
-            "score": 7,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1546.003",
+            "techniqueID": "T1120",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
-        },
-        {
-            "techniqueID": "T1023",
-            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1590",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1098",
-            "score": -8,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1195.002",
-            "score": 7,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1570",
-            "score": 7,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1075",
-            "score": 7,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1027.003",
-            "score": 7,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1194",
-            "score": 7,
-            "showSubtechniques": false
+            "techniqueID": "T1110.003",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
-            "techniqueID": "T1221",
-            "score": 7,
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1134",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1550.002",
+            "techniqueID": "T1546.008",
             "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
-        },
-        {
-            "techniqueID": "T1084",
-            "score": 7,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
         },
         {
-            "techniqueID": "T1001.002",
-            "score": 7,
-            "showSubtechniques": false
+            "techniqueID": "T1087",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1566.003",
-            "score": 6,
+            "techniqueID": "T1020",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
-            "techniqueID": "T1069",
-            "score": 7,
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.002",
+            "techniqueID": "T1039",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1071",
-            "score": 7,
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1547.009",
-            "score": 7,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1546.003",
+            "techniqueID": "T1158",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
-        },
-        {
-            "techniqueID": "T1023",
-            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1590",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1098",
-            "score": -8,
+            "techniqueID": "T1564.001",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1195.002",
-            "score": 7,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
         },
         {
-            "techniqueID": "T1570",
-            "score": 7,
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1075",
-            "score": 7,
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1027.003",
-            "score": 7,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1194",
-            "score": 7,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1221",
-            "score": 7,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1134",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1550.002",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
-        },
-        {
-            "techniqueID": "T1084",
-            "score": 7,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1001.002",
-            "score": 7,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566.003",
+            "techniqueID": "T1038",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
-        },
-        {
-            "techniqueID": "T1069",
-            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.002",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
-        },
-        {
-            "techniqueID": "T1071",
-            "score": 7,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1547.009",
-            "score": 7,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1546.003",
-            "score": 6,
+            "techniqueID": "T1110.003",
+            "score": -2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
-            "techniqueID": "T1023",
-            "score": 7,
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1590",
+            "techniqueID": "T1546.008",
             "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1098",
-            "score": -8,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1195.002",
-            "score": 7,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1570",
-            "score": 7,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1075",
-            "score": 7,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1027.003",
-            "score": 7,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1194",
-            "score": 7,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1221",
-            "score": 7,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
         },
         {
-            "techniqueID": "T1134",
-            "score": 3,
+            "techniqueID": "T1087",
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1550.002",
-            "score": 5,
+            "techniqueID": "T1020",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
-            "techniqueID": "T1084",
-            "score": 7,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.002",
-            "score": 7,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1566.003",
+            "techniqueID": "T1015",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
-        },
-        {
-            "techniqueID": "T1069",
-            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.002",
+            "techniqueID": "T1039",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1071",
-            "score": 7,
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1547.009",
-            "score": 7,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1546.003",
+            "techniqueID": "T1158",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
-        },
-        {
-            "techniqueID": "T1023",
-            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1590",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1098",
-            "score": -8,
+            "techniqueID": "T1564.001",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1195.002",
-            "score": 7,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
         },
         {
-            "techniqueID": "T1570",
-            "score": 7,
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1075",
-            "score": 7,
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1027.003",
-            "score": 7,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1194",
-            "score": 7,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1221",
-            "score": 7,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1134",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1550.002",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
-        },
-        {
-            "techniqueID": "T1084",
-            "score": 7,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1001.002",
-            "score": 7,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566.003",
+            "techniqueID": "T1038",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
-        },
-        {
-            "techniqueID": "T1069",
-            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.002",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
-        },
-        {
-            "techniqueID": "T1071",
-            "score": 7,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1547.009",
-            "score": 7,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1546.003",
-            "score": 6,
+            "techniqueID": "T1110.003",
+            "score": -2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
-            "techniqueID": "T1023",
-            "score": 7,
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1590",
+            "techniqueID": "T1546.008",
             "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
         },
         {
-            "techniqueID": "T1098",
-            "score": -8,
+            "techniqueID": "T1087",
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1195.002",
-            "score": 7,
-            "showSubtechniques": false
+            "techniqueID": "T1020",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
-            "techniqueID": "T1570",
-            "score": 7,
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1075",
-            "score": 7,
-            "showSubtechniques": false
+            "techniqueID": "T1039",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1027.003",
-            "score": 7,
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1194",
-            "score": 7,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1221",
-            "score": 7,
+            "techniqueID": "T1158",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1134",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1550.002",
-            "score": 5,
+            "techniqueID": "T1564.001",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
         },
         {
-            "techniqueID": "T1084",
-            "score": 7,
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1001.002",
-            "score": 7,
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566.003",
+            "techniqueID": "T1037",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
-        },
-        {
-            "techniqueID": "T1069",
-            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.002",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
-        },
-        {
-            "techniqueID": "T1071",
-            "score": 7,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1547.009",
-            "score": 7,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1546.003",
+            "techniqueID": "T1120",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
-        },
-        {
-            "techniqueID": "T1023",
-            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1590",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1098",
-            "score": -8,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1195.002",
-            "score": 7,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1570",
-            "score": 7,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1075",
-            "score": 7,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1027.003",
-            "score": 7,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1194",
-            "score": 7,
-            "showSubtechniques": false
+            "techniqueID": "T1110.003",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
-            "techniqueID": "T1221",
-            "score": 7,
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1134",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1550.002",
+            "techniqueID": "T1546.008",
             "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
-        },
-        {
-            "techniqueID": "T1084",
-            "score": 7,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
         },
         {
-            "techniqueID": "T1001.002",
-            "score": 7,
-            "showSubtechniques": false
+            "techniqueID": "T1087",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1566.003",
-            "score": 6,
+            "techniqueID": "T1020",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
-            "techniqueID": "T1069",
-            "score": 7,
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.002",
+            "techniqueID": "T1039",
             "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1071",
-            "score": 7,
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1547.009",
-            "score": 7,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1546.003",
+            "techniqueID": "T1158",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
-        },
-        {
-            "techniqueID": "T1023",
-            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1590",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1098",
-            "score": -8,
+            "techniqueID": "T1564.001",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1195.002",
-            "score": 7,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
         },
         {
-            "techniqueID": "T1570",
-            "score": 7,
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1075",
-            "score": 7,
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1027.003",
-            "score": 7,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1194",
-            "score": 7,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1221",
-            "score": 7,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1134",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1550.002",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
-        },
-        {
-            "techniqueID": "T1084",
-            "score": 7,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1001.002",
-            "score": 7,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566.003",
+            "techniqueID": "T1038",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
-        },
-        {
-            "techniqueID": "T1069",
-            "score": 7,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.002",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml"
-        },
-        {
-            "techniqueID": "T1071",
-            "score": 7,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1547.009",
-            "score": 7,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1546.003",
-            "score": 6,
+            "techniqueID": "T1110.003",
+            "score": -2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
-            "techniqueID": "T1023",
-            "score": 7,
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1590",
+            "techniqueID": "T1546.008",
             "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
         },
         {
-            "techniqueID": "T1098",
-            "score": -8,
+            "techniqueID": "T1087",
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1195.002",
-            "score": 7,
-            "showSubtechniques": false
+            "techniqueID": "T1020",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
-            "techniqueID": "T1570",
-            "score": 7,
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1075",
-            "score": 7,
-            "showSubtechniques": false
+            "techniqueID": "T1039",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1027.003",
-            "score": 7,
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1194",
-            "score": 7,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1221",
-            "score": 7,
+            "techniqueID": "T1158",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1134",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml"
-        },
-        {
-            "techniqueID": "T1550.002",
-            "score": 5,
+            "techniqueID": "T1564.001",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml"
-        },
-        {
-            "techniqueID": "T1084",
-            "score": 7,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
         },
         {
-            "techniqueID": "T1001.002",
-            "score": 7,
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566.003",
+            "techniqueID": "T1090.001",
             "score": 6,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml"
+            "showSubtechniques": false
         },
         {
             "techniqueID": "T1037",
@@ -304289,8 +305211,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -304311,8 +305234,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -304398,8 +305322,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -304420,8 +305345,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -304507,8 +305433,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -304529,8 +305456,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -304616,8 +305544,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -304638,117 +305567,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -304834,8 +305655,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -304856,8 +305678,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -304943,8 +305766,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -304965,8 +305789,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -305052,8 +305877,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -305074,8 +305900,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -305161,8 +305988,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -305183,8 +306011,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -305270,8 +306099,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -305292,8 +306122,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -305379,8 +306210,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -305401,8 +306233,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -305488,8 +306321,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -305510,8 +306344,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -305597,8 +306432,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -305619,8 +306455,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -305706,8 +306543,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -305728,8 +306566,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -305815,8 +306654,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -305837,8 +306677,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -305924,8 +306765,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -305946,8 +306788,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -306033,8 +306876,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -306055,8 +306899,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -306142,8 +306987,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -306164,8 +307010,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -306251,8 +307098,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -306273,8 +307121,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -306360,8 +307209,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -306382,8 +307232,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -306469,8 +307320,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -306491,8 +307343,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -306578,8 +307431,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -306600,8 +307454,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -306687,8 +307542,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -306709,8 +307565,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -306796,8 +307653,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -306818,117 +307676,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -307014,8 +307764,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -307036,8 +307787,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -307123,8 +307875,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -307145,8 +307898,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -307232,8 +307986,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -307254,8 +308009,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -307341,8 +308097,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -307363,8 +308120,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -307450,8 +308208,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -307472,8 +308231,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -307559,8 +308319,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -307581,8 +308342,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -307668,8 +308430,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -307690,8 +308453,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -307777,8 +308541,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -307799,8 +308564,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -307886,8 +308652,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -307908,8 +308675,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -307995,8 +308763,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -308017,8 +308786,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -308104,8 +308874,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -308126,8 +308897,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -308213,8 +308985,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -308235,8 +309008,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -308322,8 +309096,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -308344,8 +309119,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -308431,8 +309207,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -308453,8 +309230,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -308540,8 +309318,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -308562,8 +309341,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -308649,8 +309429,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -308671,8 +309452,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -308758,8 +309540,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -308780,8 +309563,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -308867,8 +309651,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -308889,8 +309674,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -308976,8 +309762,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -308998,117 +309785,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -309194,8 +309873,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -309216,8 +309896,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -309303,8 +309984,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -309325,8 +310007,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -309412,8 +310095,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -309434,8 +310118,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -309521,8 +310206,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -309543,8 +310229,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -309630,8 +310317,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -309652,8 +310340,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -309739,8 +310428,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -309761,8 +310451,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -309848,8 +310539,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -309870,8 +310562,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -309957,8 +310650,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -309979,8 +310673,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -310066,8 +310761,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -310088,8 +310784,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -310175,8 +310872,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -310197,8 +310895,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -310284,8 +310983,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -310306,8 +311006,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -310393,8 +311094,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -310415,8 +311117,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -310502,8 +311205,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -310524,8 +311228,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -310611,8 +311316,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -310633,8 +311339,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -310720,8 +311427,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -310742,8 +311450,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -310829,8 +311538,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -310851,8 +311561,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -310938,8 +311649,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -310960,8 +311672,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -311047,8 +311760,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -311069,8 +311783,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -311156,8 +311871,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -311178,117 +311894,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -311374,8 +311982,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -311396,8 +312005,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -311483,8 +312093,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -311505,8 +312116,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -311592,8 +312204,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -311614,8 +312227,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -311701,8 +312315,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -311723,8 +312338,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -311810,8 +312426,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -311832,8 +312449,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -311919,8 +312537,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -311941,8 +312560,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -312028,8 +312648,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -312050,8 +312671,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -312137,8 +312759,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -312159,8 +312782,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -312246,8 +312870,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -312268,8 +312893,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -312355,8 +312981,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -312377,8 +313004,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -312464,8 +313092,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -312486,8 +313115,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -312573,8 +313203,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -312595,8 +313226,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -312682,8 +313314,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -312704,8 +313337,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -312791,8 +313425,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -312813,8 +313448,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -312900,8 +313536,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -312922,8 +313559,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -313009,8 +313647,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -313031,8 +313670,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -313118,8 +313758,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -313140,8 +313781,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -313227,8 +313869,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -313249,8 +313892,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -313336,8 +313980,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -313358,117 +314003,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -313554,8 +314091,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -313576,8 +314114,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -313663,8 +314202,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -313685,8 +314225,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -313772,8 +314313,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -313794,8 +314336,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -313881,8 +314424,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -313903,8 +314447,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -313990,8 +314535,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -314012,8 +314558,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -314099,8 +314646,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -314121,8 +314669,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -314208,8 +314757,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -314230,8 +314780,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -314317,8 +314868,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -314339,8 +314891,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -314426,8 +314979,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -314448,8 +315002,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -314535,8 +315090,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -314557,8 +315113,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -314644,8 +315201,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -314666,8 +315224,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -314753,8 +315312,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -314775,8 +315335,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -314862,8 +315423,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -314884,8 +315446,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -314971,8 +315534,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -314993,8 +315557,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -315080,8 +315645,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -315102,8 +315668,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -315189,8 +315756,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -315211,8 +315779,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -315298,8 +315867,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -315320,8 +315890,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -315407,8 +315978,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -315429,8 +316001,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -315516,8 +316089,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -315538,117 +316112,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -315734,8 +316200,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -315756,8 +316223,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -315843,8 +316311,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -315865,8 +316334,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -315952,8 +316422,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -315974,8 +316445,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -316061,8 +316533,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -316083,8 +316556,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -316170,8 +316644,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -316192,8 +316667,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -316279,8 +316755,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -316301,8 +316778,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -316388,8 +316866,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -316410,8 +316889,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -316497,8 +316977,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -316519,8 +317000,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -316606,8 +317088,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -316628,8 +317111,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -316715,8 +317199,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -316737,8 +317222,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -316824,8 +317310,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -316846,8 +317333,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -316933,8 +317421,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -316955,8 +317444,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -317042,8 +317532,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -317064,8 +317555,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -317151,8 +317643,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -317173,8 +317666,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -317260,8 +317754,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -317282,8 +317777,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -317369,8 +317865,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -317391,8 +317888,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -317478,8 +317976,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -317500,8 +317999,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -317587,8 +318087,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -317609,8 +318110,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -317696,8 +318198,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -317718,117 +318221,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -317914,8 +318309,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -317936,8 +318332,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -318023,8 +318420,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -318045,8 +318443,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -318132,8 +318531,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -318154,8 +318554,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -318241,8 +318642,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -318263,8 +318665,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -318350,8 +318753,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -318372,8 +318776,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -318459,8 +318864,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -318481,8 +318887,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -318568,8 +318975,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -318590,8 +318998,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -318677,8 +319086,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -318699,8 +319109,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -318786,8 +319197,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -318808,8 +319220,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -318895,8 +319308,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -318917,8 +319331,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -319004,8 +319419,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -319026,8 +319442,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -319113,8 +319530,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -319135,8 +319553,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -319222,8 +319641,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -319244,8 +319664,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -319331,8 +319752,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -319353,8 +319775,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -319440,8 +319863,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -319462,8 +319886,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -319549,8 +319974,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -319571,8 +319997,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -319658,8 +320085,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -319680,8 +320108,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -319767,8 +320196,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -319789,8 +320219,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -319876,8 +320307,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -319898,117 +320330,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -320094,8 +320418,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -320116,8 +320441,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -320203,8 +320529,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -320225,8 +320552,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -320312,8 +320640,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -320334,8 +320663,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -320421,8 +320751,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -320443,8 +320774,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -320530,8 +320862,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -320552,8 +320885,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -320639,8 +320973,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -320661,8 +320996,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -320748,8 +321084,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -320770,8 +321107,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -320857,8 +321195,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -320879,8 +321218,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -320966,8 +321306,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -320988,8 +321329,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -321075,8 +321417,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -321097,8 +321440,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -321184,8 +321528,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -321206,8 +321551,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -321293,8 +321639,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -321315,8 +321662,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -321402,8 +321750,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -321424,8 +321773,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -321511,8 +321861,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -321533,8 +321884,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -321620,8 +321972,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -321642,8 +321995,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -321729,8 +322083,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -321751,8 +322106,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -321838,8 +322194,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -321860,8 +322217,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -321947,8 +322305,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -321969,8 +322328,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -322056,8 +322416,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -322078,117 +322439,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -322274,8 +322527,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -322296,8 +322550,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -322383,8 +322638,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -322405,8 +322661,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -322492,8 +322749,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -322514,8 +322772,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -322601,8 +322860,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -322623,8 +322883,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -322710,8 +322971,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -322732,8 +322994,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -322819,8 +323082,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -322841,8 +323105,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -322928,8 +323193,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -322950,8 +323216,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -323037,8 +323304,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -323059,8 +323327,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -323146,8 +323415,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -323168,8 +323438,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -323255,8 +323526,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -323277,8 +323549,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -323364,8 +323637,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -323386,8 +323660,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -323473,8 +323748,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -323495,8 +323771,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -323582,8 +323859,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -323604,8 +323882,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -323691,8 +323970,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -323713,8 +323993,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -323800,8 +324081,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -323822,8 +324104,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -323909,8 +324192,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -323931,8 +324215,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -324018,8 +324303,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -324040,8 +324326,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -324127,8 +324414,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -324149,8 +324437,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -324236,8 +324525,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -324258,117 +324548,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -324454,8 +324636,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -324476,8 +324659,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -324563,8 +324747,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -324585,8 +324770,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -324672,8 +324858,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -324694,8 +324881,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -324781,8 +324969,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -324803,8 +324992,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -324890,8 +325080,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -324912,8 +325103,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -324999,8 +325191,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -325021,8 +325214,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -325108,8 +325302,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -325130,8 +325325,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -325217,8 +325413,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -325239,8 +325436,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -325326,8 +325524,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -325348,8 +325547,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -325435,8 +325635,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -325457,8 +325658,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -325544,8 +325746,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -325566,8 +325769,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -325653,8 +325857,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -325675,8 +325880,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -325762,8 +325968,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -325784,8 +325991,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -325871,8 +326079,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -325893,8 +326102,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -325980,8 +326190,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -326002,8 +326213,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -326089,8 +326301,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -326111,8 +326324,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -326198,8 +326412,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -326220,8 +326435,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -326307,8 +326523,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -326329,8 +326546,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -326416,8 +326634,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -326438,117 +326657,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -326634,8 +326745,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -326656,8 +326768,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -326743,8 +326856,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -326765,8 +326879,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -326852,8 +326967,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -326874,8 +326990,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -326961,8 +327078,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -326983,8 +327101,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -327070,8 +327189,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -327092,8 +327212,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -327179,8 +327300,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -327201,8 +327323,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -327288,8 +327411,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -327310,8 +327434,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -327397,8 +327522,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -327419,8 +327545,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -327506,8 +327633,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -327528,8 +327656,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -327615,8 +327744,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -327637,8 +327767,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -327724,8 +327855,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -327746,8 +327878,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -327833,8 +327966,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -327855,8 +327989,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -327942,8 +328077,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -327964,8 +328100,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -328051,8 +328188,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -328073,8 +328211,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -328160,8 +328299,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -328182,8 +328322,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -328269,8 +328410,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -328291,8 +328433,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -328378,8 +328521,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -328400,8 +328544,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -328487,8 +328632,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -328509,8 +328655,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -328596,8 +328743,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -328618,117 +328766,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -328814,8 +328854,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -328836,8 +328877,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -328923,8 +328965,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -328945,8 +328988,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -329032,8 +329076,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -329054,8 +329099,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -329141,8 +329187,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -329163,8 +329210,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -329250,8 +329298,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -329272,8 +329321,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -329359,8 +329409,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -329381,8 +329432,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -329468,8 +329520,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -329490,8 +329543,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -329577,8 +329631,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -329599,8 +329654,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -329686,8 +329742,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -329708,8 +329765,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -329795,8 +329853,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -329817,8 +329876,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -329904,8 +329964,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -329926,8 +329987,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -330013,8 +330075,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -330035,8 +330098,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -330122,8 +330186,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -330144,8 +330209,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -330231,8 +330297,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -330253,8 +330320,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -330340,8 +330408,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -330362,8 +330431,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -330449,8 +330519,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -330471,8 +330542,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -330558,8 +330630,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -330580,8 +330653,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -330667,8 +330741,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -330689,8 +330764,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -330776,8 +330852,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -330798,117 +330875,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -330994,8 +330963,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -331016,8 +330986,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -331103,8 +331074,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -331125,8 +331097,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -331212,8 +331185,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -331234,8 +331208,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -331321,8 +331296,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -331343,8 +331319,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -331430,8 +331407,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -331452,8 +331430,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -331539,8 +331518,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -331561,8 +331541,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -331648,8 +331629,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -331670,8 +331652,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -331757,8 +331740,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -331779,8 +331763,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -331866,8 +331851,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -331888,8 +331874,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -331975,8 +331962,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -331997,8 +331985,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -332084,8 +332073,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -332106,8 +332096,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -332193,8 +332184,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -332215,8 +332207,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -332302,8 +332295,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -332324,8 +332318,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -332411,8 +332406,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -332433,8 +332429,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -332520,8 +332517,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -332542,8 +332540,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -332629,8 +332628,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -332651,8 +332651,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -332738,8 +332739,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -332760,8 +332762,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -332847,8 +332850,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -332869,8 +332873,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -332956,8 +332961,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -332978,117 +332984,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -333174,8 +333072,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -333196,8 +333095,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -333283,8 +333183,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -333305,8 +333206,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -333392,8 +333294,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -333414,8 +333317,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -333501,8 +333405,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -333523,8 +333428,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -333610,8 +333516,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -333632,8 +333539,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -333719,8 +333627,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -333741,8 +333650,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -333828,8 +333738,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -333850,8 +333761,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -333937,8 +333849,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -333959,8 +333872,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -334046,8 +333960,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -334068,8 +333983,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -334155,8 +334071,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -334177,8 +334094,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -334264,8 +334182,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -334286,8 +334205,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -334373,8 +334293,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -334395,8 +334316,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -334482,8 +334404,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -334504,8 +334427,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -334591,8 +334515,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -334613,8 +334538,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -334700,8 +334626,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -334722,8 +334649,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -334809,8 +334737,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -334831,8 +334760,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -334918,8 +334848,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -334940,8 +334871,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -335027,8 +334959,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -335049,8 +334982,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -335136,8 +335070,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -335158,117 +335093,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -335354,8 +335181,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -335376,8 +335204,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -335463,8 +335292,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -335485,8 +335315,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -335572,8 +335403,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -335594,8 +335426,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -335681,8 +335514,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -335703,8 +335537,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -335790,8 +335625,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -335812,8 +335648,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -335899,8 +335736,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -335921,8 +335759,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -336008,8 +335847,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -336030,8 +335870,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -336117,8 +335958,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -336139,8 +335981,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -336226,8 +336069,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -336248,8 +336092,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -336335,8 +336180,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -336357,8 +336203,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -336444,8 +336291,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -336466,8 +336314,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -336553,8 +336402,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -336575,8 +336425,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -336662,8 +336513,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -336684,8 +336536,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -336771,8 +336624,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -336793,8 +336647,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -336880,8 +336735,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -336902,8 +336758,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -336989,8 +336846,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -337011,8 +336869,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -337098,8 +336957,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -337120,8 +336980,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -337207,8 +337068,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -337229,8 +337091,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -337316,8 +337179,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -337338,117 +337202,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -337534,8 +337290,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -337556,8 +337313,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -337643,8 +337401,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -337665,8 +337424,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -337752,8 +337512,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -337774,8 +337535,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -337861,8 +337623,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -337883,8 +337646,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -337970,8 +337734,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -337992,8 +337757,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -338079,8 +337845,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -338101,8 +337868,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -338188,8 +337956,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -338210,8 +337979,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -338297,8 +338067,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -338319,8 +338090,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -338406,8 +338178,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -338428,8 +338201,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -338515,8 +338289,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -338537,8 +338312,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -338624,8 +338400,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -338646,8 +338423,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -338733,8 +338511,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -338755,8 +338534,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -338842,8 +338622,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -338864,8 +338645,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -338951,8 +338733,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -338973,8 +338756,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -339060,8 +338844,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -339082,8 +338867,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -339169,8 +338955,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -339191,8 +338978,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -339278,8 +339066,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -339300,8 +339089,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -339387,8 +339177,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -339409,8 +339200,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -339496,8 +339288,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -339518,117 +339311,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -339714,8 +339399,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -339736,8 +339422,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -339823,8 +339510,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -339845,8 +339533,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -339932,8 +339621,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -339954,8 +339644,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -340041,8 +339732,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -340063,8 +339755,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -340150,8 +339843,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -340172,8 +339866,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -340259,8 +339954,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -340281,8 +339977,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -340368,8 +340065,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -340390,8 +340088,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -340477,8 +340176,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -340499,8 +340199,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -340586,8 +340287,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -340608,8 +340310,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -340695,8 +340398,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -340717,8 +340421,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -340804,8 +340509,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -340826,8 +340532,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -340913,8 +340620,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -340935,8 +340643,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -341022,8 +340731,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -341044,8 +340754,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -341131,8 +340842,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -341153,8 +340865,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -341240,8 +340953,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -341262,8 +340976,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -341349,8 +341064,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -341371,8 +341087,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -341458,8 +341175,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -341480,8 +341198,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -341567,8 +341286,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -341589,8 +341309,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -341676,8 +341397,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -341698,117 +341420,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1015",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1039",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1573.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1095",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1158",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
-        },
-        {
-            "techniqueID": "T1055.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1090.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.001",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1040",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1120",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1586.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1038",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1585.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.002",
-            "score": 6,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1546.008",
-            "score": 5,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
-        },
-        {
-            "techniqueID": "T1087",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
-        },
-        {
-            "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -341894,8 +341508,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -341916,8 +341531,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -342003,8 +341619,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -342025,8 +341642,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -342112,8 +341730,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -342134,8 +341753,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -342221,8 +341841,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -342243,8 +341864,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -342330,8 +341952,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -342352,8 +341975,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -342439,8 +342063,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -342461,8 +342086,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -342548,8 +342174,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -342570,8 +342197,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -342657,8 +342285,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -342679,8 +342308,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -342766,8 +342396,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -342788,8 +342419,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -342875,8 +342507,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -342897,8 +342530,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -342984,8 +342618,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -343006,8 +342641,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -343093,8 +342729,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -343115,8 +342752,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -343202,8 +342840,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -343224,8 +342863,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -343311,8 +342951,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -343333,8 +342974,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -343420,8 +343062,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -343442,8 +343085,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -343529,8 +343173,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -343551,8 +343196,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -343638,8 +343284,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -343660,8 +343307,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -343747,8 +343395,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -343769,8 +343418,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -343856,8 +343506,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -343878,8 +343529,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -343965,8 +343617,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -343987,8 +343640,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -344074,8 +343728,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -344096,8 +343751,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -344183,8 +343839,9 @@
         },
         {
             "techniqueID": "T1110.003",
-            "score": 6,
-            "showSubtechniques": false
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -344205,8 +343862,9 @@
         },
         {
             "techniqueID": "T1020",
-            "score": 6,
-            "showSubtechniques": false
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
             "techniqueID": "T1015",
@@ -344251,1027 +343909,1446 @@
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1560.003",
-            "score": 5,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1069.002",
-            "score": 5,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.007",
-            "score": 5,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1572",
-            "score": 5,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.003",
-            "score": 5,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1583.004",
-            "score": 5,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1021.006",
-            "score": 5,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568",
-            "score": 5,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1188",
-            "score": 5,
+            "techniqueID": "T1110.003",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
+        {
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1210",
+            "techniqueID": "T1546.008",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
+        },
+        {
+            "techniqueID": "T1087",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1020",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
-            "techniqueID": "T1069.001",
-            "score": 5,
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566",
-            "score": 4,
+            "techniqueID": "T1039",
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "techniqueID": "T1573.002",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1095",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1158",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.001",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
         },
         {
-            "techniqueID": "T1090.003",
-            "score": 5,
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1001",
-            "score": 5,
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1056",
-            "score": 5,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1567.002",
-            "score": 5,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1028",
-            "score": 5,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1499",
-            "score": 5,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1598",
-            "score": 5,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1223",
-            "score": 5,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1213",
-            "score": 5,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1584.004",
-            "score": 5,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587",
-            "score": 5,
+            "techniqueID": "T1110.003",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
+        {
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1102.001",
+            "techniqueID": "T1546.008",
             "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
+        },
+        {
+            "techniqueID": "T1087",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1020",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
+        {
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1560.003",
-            "score": 5,
+            "techniqueID": "T1039",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1069.002",
-            "score": 5,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.007",
-            "score": 5,
+            "techniqueID": "T1158",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1572",
-            "score": 5,
+            "techniqueID": "T1564.001",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
+        },
+        {
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.003",
-            "score": 5,
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1583.004",
-            "score": 5,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1021.006",
-            "score": 5,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568",
-            "score": 5,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1188",
-            "score": 5,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1210",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+            "techniqueID": "T1586.002",
+            "score": 6,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1069.001",
-            "score": 5,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
+            "techniqueID": "T1550",
+            "score": 6,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "techniqueID": "T1585.002",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.003",
+            "score": -2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
-            "techniqueID": "T1090.003",
-            "score": 5,
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1001",
+            "techniqueID": "T1546.008",
             "score": 5,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
         },
         {
-            "techniqueID": "T1056",
-            "score": 5,
+            "techniqueID": "T1087",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1020",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
+        {
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1567.002",
-            "score": 5,
+            "techniqueID": "T1039",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1028",
-            "score": 5,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1499",
-            "score": 5,
+            "techniqueID": "T1158",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1598",
-            "score": 5,
+            "techniqueID": "T1564.001",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
+        },
+        {
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1223",
-            "score": 5,
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1213",
-            "score": 5,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1584.004",
-            "score": 5,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587",
-            "score": 5,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1102.001",
-            "score": 5,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1560.003",
-            "score": 5,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1069.002",
-            "score": 5,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.007",
-            "score": 5,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1572",
-            "score": 5,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.003",
-            "score": 5,
+            "techniqueID": "T1110.003",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
+        {
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1583.004",
+            "techniqueID": "T1546.008",
             "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
+        },
+        {
+            "techniqueID": "T1087",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1020",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
+        {
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1021.006",
-            "score": 5,
+            "techniqueID": "T1039",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568",
-            "score": 5,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1188",
-            "score": 5,
+            "techniqueID": "T1158",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1210",
+            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
         },
         {
-            "techniqueID": "T1069.001",
-            "score": 5,
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
+            "techniqueID": "T1090.001",
+            "score": 6,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.001",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
+            "techniqueID": "T1037",
+            "score": 6,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1090.003",
-            "score": 5,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1001",
-            "score": 5,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1056",
-            "score": 5,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1567.002",
-            "score": 5,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1028",
-            "score": 5,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1499",
-            "score": 5,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1598",
-            "score": 5,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1223",
-            "score": 5,
+            "techniqueID": "T1110.003",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
+        {
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1213",
+            "techniqueID": "T1546.008",
             "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
+        },
+        {
+            "techniqueID": "T1087",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1020",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
+        {
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1584.004",
-            "score": 5,
+            "techniqueID": "T1039",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587",
-            "score": 5,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1102.001",
-            "score": 5,
+            "techniqueID": "T1158",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1560.003",
-            "score": 5,
+            "techniqueID": "T1564.001",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
+        },
+        {
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1069.002",
-            "score": 5,
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.007",
-            "score": 5,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1572",
-            "score": 5,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.003",
-            "score": 5,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1583.004",
-            "score": 5,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1021.006",
-            "score": 5,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568",
-            "score": 5,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1188",
-            "score": 5,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1210",
-            "score": 4,
+            "techniqueID": "T1585.002",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.003",
+            "score": -2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
-            "techniqueID": "T1069.001",
-            "score": 5,
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566",
-            "score": 4,
+            "techniqueID": "T1546.008",
+            "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
         },
         {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "techniqueID": "T1087",
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
+            "techniqueID": "T1020",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
-            "techniqueID": "T1001",
-            "score": 5,
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
+            "techniqueID": "T1039",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1567.002",
-            "score": 5,
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1028",
-            "score": 5,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1499",
-            "score": 5,
+            "techniqueID": "T1158",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1598",
-            "score": 5,
+            "techniqueID": "T1564.001",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
+        },
+        {
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1223",
-            "score": 5,
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1213",
-            "score": 5,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1584.004",
-            "score": 5,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587",
-            "score": 5,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1102.001",
-            "score": 5,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1560.003",
-            "score": 5,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1069.002",
-            "score": 5,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.007",
-            "score": 5,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1572",
-            "score": 5,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.003",
-            "score": 5,
+            "techniqueID": "T1110.003",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
+        {
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1583.004",
+            "techniqueID": "T1546.008",
             "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
+        },
+        {
+            "techniqueID": "T1087",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1020",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
+        {
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1021.006",
-            "score": 5,
+            "techniqueID": "T1039",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568",
-            "score": 5,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1188",
-            "score": 5,
+            "techniqueID": "T1158",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1210",
+            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
         },
         {
-            "techniqueID": "T1069.001",
-            "score": 5,
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
+            "techniqueID": "T1090.001",
+            "score": 6,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.001",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
+            "techniqueID": "T1037",
+            "score": 6,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1090.003",
-            "score": 5,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1001",
-            "score": 5,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1056",
-            "score": 5,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1567.002",
-            "score": 5,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1028",
-            "score": 5,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1499",
-            "score": 5,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1598",
-            "score": 5,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1223",
-            "score": 5,
+            "techniqueID": "T1110.003",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
+        {
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1213",
+            "techniqueID": "T1546.008",
             "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
+        },
+        {
+            "techniqueID": "T1087",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1020",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
+        {
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1584.004",
-            "score": 5,
+            "techniqueID": "T1039",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587",
-            "score": 5,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1102.001",
-            "score": 5,
+            "techniqueID": "T1158",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1560.003",
-            "score": 5,
+            "techniqueID": "T1564.001",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
+        },
+        {
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1069.002",
-            "score": 5,
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.007",
-            "score": 5,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1572",
-            "score": 5,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.003",
-            "score": 5,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1583.004",
-            "score": 5,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1021.006",
-            "score": 5,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568",
-            "score": 5,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1188",
-            "score": 5,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1210",
-            "score": 4,
+            "techniqueID": "T1585.002",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.003",
+            "score": -2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
-            "techniqueID": "T1069.001",
-            "score": 5,
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566",
-            "score": 4,
+            "techniqueID": "T1546.008",
+            "score": 5,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
         },
         {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "techniqueID": "T1087",
+            "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1090.003",
-            "score": 5,
-            "showSubtechniques": false
+            "techniqueID": "T1020",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
-            "techniqueID": "T1001",
-            "score": 5,
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1056",
-            "score": 5,
-            "showSubtechniques": false
+            "techniqueID": "T1039",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1567.002",
-            "score": 5,
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1028",
-            "score": 5,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1499",
-            "score": 5,
+            "techniqueID": "T1158",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1598",
-            "score": 5,
+            "techniqueID": "T1564.001",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
+        },
+        {
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1223",
-            "score": 5,
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1213",
-            "score": 5,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1584.004",
-            "score": 5,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587",
-            "score": 5,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1102.001",
-            "score": 5,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1560.003",
-            "score": 5,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1069.002",
-            "score": 5,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.007",
-            "score": 5,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1572",
-            "score": 5,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.003",
-            "score": 5,
+            "techniqueID": "T1110.003",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
+        {
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1583.004",
+            "techniqueID": "T1546.008",
             "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
+        },
+        {
+            "techniqueID": "T1087",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1020",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
+        {
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1021.006",
-            "score": 5,
+            "techniqueID": "T1039",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568",
-            "score": 5,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1188",
-            "score": 5,
+            "techniqueID": "T1158",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1210",
+            "techniqueID": "T1564.001",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
         },
         {
-            "techniqueID": "T1069.001",
-            "score": 5,
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566",
-            "score": 4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
+            "techniqueID": "T1090.001",
+            "score": 6,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.001",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
+            "techniqueID": "T1037",
+            "score": 6,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1090.003",
-            "score": 5,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1001",
-            "score": 5,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1056",
-            "score": 5,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1567.002",
-            "score": 5,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1028",
-            "score": 5,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1499",
-            "score": 5,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1598",
-            "score": 5,
+            "techniqueID": "T1585.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1223",
-            "score": 5,
+            "techniqueID": "T1110.003",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
+        {
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1213",
+            "techniqueID": "T1546.008",
             "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
+        },
+        {
+            "techniqueID": "T1087",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1020",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
+        {
+            "techniqueID": "T1015",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1584.004",
-            "score": 5,
+            "techniqueID": "T1039",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587",
-            "score": 5,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1102.001",
-            "score": 5,
+            "techniqueID": "T1158",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1560.003",
-            "score": 5,
+            "techniqueID": "T1564.001",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
+        },
+        {
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1069.002",
-            "score": 5,
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.007",
-            "score": 5,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1572",
-            "score": 5,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.003",
-            "score": 5,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1583.004",
-            "score": 5,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1021.006",
-            "score": 5,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568",
-            "score": 5,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1188",
-            "score": 5,
+            "techniqueID": "T1550",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1210",
-            "score": 4,
+            "techniqueID": "T1585.002",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.003",
+            "score": -2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
         },
         {
-            "techniqueID": "T1069.001",
-            "score": 5,
+            "techniqueID": "T1589.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1566",
+            "techniqueID": "T1546.008",
+            "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
+        },
+        {
+            "techniqueID": "T1087",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1020",
             "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
         },
         {
-            "techniqueID": "T1218.001",
-            "score": 1,
+            "techniqueID": "T1015",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1039",
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1090.003",
-            "score": 5,
+            "techniqueID": "T1573.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1001",
-            "score": 5,
+            "techniqueID": "T1095",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1056",
-            "score": 5,
+            "techniqueID": "T1158",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1567.002",
-            "score": 5,
+            "techniqueID": "T1564.001",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
+        },
+        {
+            "techniqueID": "T1055.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1028",
-            "score": 5,
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1499",
-            "score": 5,
+            "techniqueID": "T1037",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1598",
-            "score": 5,
+            "techniqueID": "T1574.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1223",
-            "score": 5,
+            "techniqueID": "T1040",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1213",
-            "score": 5,
+            "techniqueID": "T1120",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1584.004",
-            "score": 5,
+            "techniqueID": "T1586.002",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587",
-            "score": 5,
+            "techniqueID": "T1038",
+            "score": 6,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1102.001",
+            "techniqueID": "T1550",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585.002",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1110.003",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml"
+        },
+        {
+            "techniqueID": "T1589.002",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1546.008",
             "score": 5,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml"
+        },
+        {
+            "techniqueID": "T1087",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1020",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml"
+        },
+        {
+            "techniqueID": "T1015",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1039",
+            "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1573.002",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1095",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1158",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.001",
+            "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml"
+        },
+        {
+            "techniqueID": "T1055.001",
+            "score": 6,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1090.001",
+            "score": 6,
             "showSubtechniques": false
         },
         {
@@ -391227,939 +391304,1027 @@
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1069.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
-            "score": 4,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml"
+            "techniqueID": "T1572",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.004",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
+            "techniqueID": "T1210",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+        },
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
+            "techniqueID": "T1566",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
+        },
+        {
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1145",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1598",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "techniqueID": "T1213",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.002",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml"
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml"
+            "techniqueID": "T1218.007",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1496",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "techniqueID": "T1071.003",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1021.006",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
+            "techniqueID": "T1210",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+        },
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
+            "techniqueID": "T1566",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
+            "techniqueID": "T1218.001",
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
         },
         {
-            "techniqueID": "T1588.004",
-            "score": 4,
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1598",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1145",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
-            "score": 4,
+            "techniqueID": "T1069.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "techniqueID": "T1218.007",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.002",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
+            "techniqueID": "T1021.006",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1188",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1210",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+        },
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
+            "techniqueID": "T1566",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1197",
+            "techniqueID": "T1218.001",
             "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
         },
         {
-            "techniqueID": "T1496",
-            "score": 4,
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "techniqueID": "T1001",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1567.002",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1598",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml"
+            "techniqueID": "T1213",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.004",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1069.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1145",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
+            "techniqueID": "T1210",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+        },
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
+            "techniqueID": "T1566",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
+            "techniqueID": "T1218.001",
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
         },
         {
-            "techniqueID": "T1588.002",
-            "score": 4,
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml"
+            "techniqueID": "T1028",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml"
+            "techniqueID": "T1499",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1496",
-            "score": 4,
+            "techniqueID": "T1598",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "techniqueID": "T1223",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1584.004",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
-            "score": 4,
+            "techniqueID": "T1069.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml"
+            "techniqueID": "T1218.007",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.004",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
+            "techniqueID": "T1210",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+        },
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
+            "techniqueID": "T1566",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
+        },
+        {
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1145",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
-            "score": 4,
+            "techniqueID": "T1598",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "techniqueID": "T1223",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.002",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml"
+            "techniqueID": "T1560.003",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml"
+            "techniqueID": "T1069.002",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1496",
-            "score": 4,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "techniqueID": "T1572",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1583.004",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
+            "techniqueID": "T1210",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+        },
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
+            "techniqueID": "T1566",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1588.004",
-            "score": 4,
+            "techniqueID": "T1218.001",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
+        },
+        {
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1598",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1145",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
-            "score": 4,
+            "techniqueID": "T1069.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "techniqueID": "T1218.007",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.002",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
+            "techniqueID": "T1021.006",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1188",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1210",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+        },
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
+            "techniqueID": "T1566",
+            "score": 4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1197",
+            "techniqueID": "T1218.001",
             "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
         },
         {
-            "techniqueID": "T1496",
-            "score": 4,
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "techniqueID": "T1001",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1567.002",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1028",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1596.003",
-            "score": 4,
+            "techniqueID": "T1499",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1561.002",
-            "score": 4,
+            "techniqueID": "T1598",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1014",
-            "score": 4,
+            "techniqueID": "T1223",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml"
+            "techniqueID": "T1213",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.004",
-            "score": 4,
+            "techniqueID": "T1584.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1093",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.003",
-            "score": 4,
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1110.002",
-            "score": 4,
+            "techniqueID": "T1560.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1586.001",
-            "score": 4,
+            "techniqueID": "T1069.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1487",
-            "score": 4,
+            "techniqueID": "T1218.007",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1091",
-            "score": 4,
+            "techniqueID": "T1572",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589",
-            "score": 4,
+            "techniqueID": "T1071.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1145",
-            "score": 4,
+            "techniqueID": "T1583.004",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1552.004",
-            "score": 4,
+            "techniqueID": "T1021.006",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.005",
-            "score": 4,
+            "techniqueID": "T1568",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.002",
-            "score": 4,
+            "techniqueID": "T1188",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497",
+            "techniqueID": "T1210",
             "score": 4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml"
+        },
+        {
+            "techniqueID": "T1069.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1071.002",
+            "techniqueID": "T1566",
             "score": 4,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml"
         },
         {
-            "techniqueID": "T1199",
-            "score": 3,
+            "techniqueID": "T1218.001",
+            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml"
         },
         {
-            "techniqueID": "T1588.002",
-            "score": 4,
+            "techniqueID": "T1090.003",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585.001",
-            "score": 4,
+            "techniqueID": "T1001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1055.012",
-            "score": 4,
+            "techniqueID": "T1056",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1208",
-            "score": 4,
+            "techniqueID": "T1567.002",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1486",
-            "score": -2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml"
+            "techniqueID": "T1028",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1197",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml"
+            "techniqueID": "T1499",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1496",
-            "score": 4,
+            "techniqueID": "T1598",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1585",
-            "score": 3,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml"
+            "techniqueID": "T1223",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1008",
-            "score": 4,
+            "techniqueID": "T1213",
+            "score": 5,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1558.003",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml"
+            "techniqueID": "T1584.004",
+            "score": 5,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1094",
-            "score": 4,
+            "techniqueID": "T1587",
+            "score": 5,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1102.001",
+            "score": 5,
             "showSubtechniques": false
         },
         {
@@ -448479,811 +448644,939 @@
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1067",
-            "score": 3,
+            "techniqueID": "T1596.003",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1557",
-            "score": 3,
+            "techniqueID": "T1561.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1213.002",
-            "score": 3,
+            "techniqueID": "T1014",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1016.001",
+            "techniqueID": "T1114",
             "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1542.003",
-            "score": 3,
+            "techniqueID": "T1093",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1025",
-            "score": 3,
+            "techniqueID": "T1587.003",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114.001",
-            "score": 3,
+            "techniqueID": "T1110.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1080",
-            "score": 3,
+            "techniqueID": "T1586.001",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497.001",
-            "score": 3,
+            "techniqueID": "T1487",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1115",
-            "score": 3,
+            "techniqueID": "T1091",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.002",
-            "score": 3,
+            "techniqueID": "T1589",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1584.003",
-            "score": 3,
+            "techniqueID": "T1145",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1567",
-            "score": 3,
+            "techniqueID": "T1552.004",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1562.002",
-            "score": 3,
+            "techniqueID": "T1003.005",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1004",
-            "score": 3,
+            "techniqueID": "T1036.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1595.002",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1547.004",
-            "score": 3,
+            "techniqueID": "T1071.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1482",
-            "score": 0,
+            "techniqueID": "T1199",
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1583.003",
-            "score": 3,
+            "techniqueID": "T1588.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1550.003",
-            "score": 3,
+            "techniqueID": "T1585.001",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1074",
-            "score": 3,
+            "techniqueID": "T1055.012",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1104",
-            "score": 3,
+            "techniqueID": "T1208",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1072",
-            "score": 2,
+            "techniqueID": "T1486",
+            "score": -2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml"
         },
         {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml"
         },
         {
-            "techniqueID": "T1097",
-            "score": 3,
+            "techniqueID": "T1496",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1201",
-            "score": 2,
+            "techniqueID": "T1585",
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1573",
-            "score": 3,
+            "techniqueID": "T1008",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589.001",
+            "techniqueID": "T1558.003",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml"
         },
         {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "techniqueID": "T1094",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1027.004",
-            "score": 3,
+            "techniqueID": "T1596.003",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1500",
-            "score": 3,
+            "techniqueID": "T1561.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1555.004",
-            "score": 3,
+            "techniqueID": "T1014",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1485",
-            "score": 0,
+            "techniqueID": "T1114",
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml"
         },
         {
-            "techniqueID": "T1498",
-            "score": 3,
+            "techniqueID": "T1588.004",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1098.002",
-            "score": 3,
+            "techniqueID": "T1093",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.003",
-            "score": 3,
+            "techniqueID": "T1587.003",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.006",
-            "score": 3,
+            "techniqueID": "T1110.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1053.002",
-            "score": 3,
+            "techniqueID": "T1586.001",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1529",
-            "score": 3,
+            "techniqueID": "T1487",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1067",
-            "score": 3,
+            "techniqueID": "T1091",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1557",
-            "score": 3,
+            "techniqueID": "T1589",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1213.002",
-            "score": 3,
+            "techniqueID": "T1145",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1016.001",
-            "score": 3,
+            "techniqueID": "T1552.004",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1542.003",
-            "score": 3,
+            "techniqueID": "T1003.005",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1025",
-            "score": 3,
+            "techniqueID": "T1036.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114.001",
-            "score": 3,
+            "techniqueID": "T1497",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1080",
-            "score": 3,
+            "techniqueID": "T1071.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497.001",
+            "techniqueID": "T1199",
             "score": 3,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1115",
-            "score": 3,
+            "techniqueID": "T1588.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.002",
-            "score": 3,
+            "techniqueID": "T1585.001",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1584.003",
-            "score": 3,
+            "techniqueID": "T1055.012",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1567",
-            "score": 3,
+            "techniqueID": "T1208",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1562.002",
-            "score": 3,
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1004",
+            "techniqueID": "T1585",
             "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1595.002",
+            "techniqueID": "T1558.003",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml"
         },
         {
-            "techniqueID": "T1547.004",
-            "score": 3,
+            "techniqueID": "T1094",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "techniqueID": "T1596.003",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1583.003",
-            "score": 3,
+            "techniqueID": "T1561.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1550.003",
-            "score": 3,
+            "techniqueID": "T1014",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1074",
+            "techniqueID": "T1114",
             "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1104",
-            "score": 3,
+            "techniqueID": "T1093",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml"
+            "techniqueID": "T1587.003",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1593",
-            "score": 3,
+            "techniqueID": "T1110.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1097",
-            "score": 3,
+            "techniqueID": "T1586.001",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+            "techniqueID": "T1487",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1573",
-            "score": 3,
+            "techniqueID": "T1091",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+            "techniqueID": "T1589",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "techniqueID": "T1145",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1027.004",
-            "score": 3,
+            "techniqueID": "T1552.004",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1500",
-            "score": 3,
+            "techniqueID": "T1003.005",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1555.004",
-            "score": 3,
+            "techniqueID": "T1036.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml"
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1498",
-            "score": 3,
+            "techniqueID": "T1071.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1098.002",
+            "techniqueID": "T1199",
             "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1588.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.003",
-            "score": 3,
+            "techniqueID": "T1585.001",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.006",
-            "score": 3,
+            "techniqueID": "T1055.012",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1053.002",
-            "score": 3,
+            "techniqueID": "T1208",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1529",
-            "score": 3,
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1067",
+            "techniqueID": "T1585",
             "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1557",
-            "score": 3,
+            "techniqueID": "T1558.003",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml"
+        },
+        {
+            "techniqueID": "T1094",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1213.002",
-            "score": 3,
+            "techniqueID": "T1596.003",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1016.001",
-            "score": 3,
+            "techniqueID": "T1561.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1542.003",
-            "score": 3,
+            "techniqueID": "T1014",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1025",
+            "techniqueID": "T1114",
             "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114.001",
-            "score": 3,
+            "techniqueID": "T1093",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1080",
-            "score": 3,
+            "techniqueID": "T1587.003",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497.001",
-            "score": 3,
+            "techniqueID": "T1110.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1115",
-            "score": 3,
+            "techniqueID": "T1586.001",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.002",
-            "score": 3,
+            "techniqueID": "T1487",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1584.003",
-            "score": 3,
+            "techniqueID": "T1091",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1567",
-            "score": 3,
+            "techniqueID": "T1589",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1562.002",
-            "score": 3,
+            "techniqueID": "T1145",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1004",
-            "score": 3,
+            "techniqueID": "T1552.004",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1595.002",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+            "techniqueID": "T1003.005",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1547.004",
-            "score": 3,
+            "techniqueID": "T1036.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1583.003",
-            "score": 3,
+            "techniqueID": "T1071.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1550.003",
+            "techniqueID": "T1199",
             "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1588.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1074",
-            "score": 3,
+            "techniqueID": "T1585.001",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1104",
-            "score": 3,
+            "techniqueID": "T1055.012",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1072",
-            "score": 2,
+            "techniqueID": "T1208",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1486",
+            "score": -2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml"
         },
         {
-            "techniqueID": "T1593",
-            "score": 3,
-            "showSubtechniques": false
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml"
         },
         {
-            "techniqueID": "T1097",
-            "score": 3,
+            "techniqueID": "T1496",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1201",
-            "score": 2,
+            "techniqueID": "T1585",
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1573",
-            "score": 3,
+            "techniqueID": "T1008",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589.001",
+            "techniqueID": "T1558.003",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml"
         },
         {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "techniqueID": "T1094",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1027.004",
-            "score": 3,
+            "techniqueID": "T1596.003",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1500",
-            "score": 3,
+            "techniqueID": "T1561.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1555.004",
-            "score": 3,
+            "techniqueID": "T1014",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1485",
-            "score": 0,
+            "techniqueID": "T1114",
+            "score": 3,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml"
         },
         {
-            "techniqueID": "T1498",
-            "score": 3,
+            "techniqueID": "T1588.004",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1098.002",
-            "score": 3,
+            "techniqueID": "T1093",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.003",
-            "score": 3,
+            "techniqueID": "T1587.003",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.006",
-            "score": 3,
+            "techniqueID": "T1110.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1053.002",
-            "score": 3,
+            "techniqueID": "T1586.001",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1529",
-            "score": 3,
+            "techniqueID": "T1487",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1067",
-            "score": 3,
+            "techniqueID": "T1091",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1557",
-            "score": 3,
+            "techniqueID": "T1589",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1213.002",
-            "score": 3,
+            "techniqueID": "T1145",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1016.001",
-            "score": 3,
+            "techniqueID": "T1552.004",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1542.003",
-            "score": 3,
+            "techniqueID": "T1003.005",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1025",
-            "score": 3,
+            "techniqueID": "T1036.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114.001",
-            "score": 3,
+            "techniqueID": "T1497",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1080",
-            "score": 3,
+            "techniqueID": "T1071.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1497.001",
+            "techniqueID": "T1199",
             "score": 3,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1115",
-            "score": 3,
+            "techniqueID": "T1588.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1587.002",
-            "score": 3,
+            "techniqueID": "T1585.001",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1584.003",
-            "score": 3,
+            "techniqueID": "T1055.012",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1567",
-            "score": 3,
+            "techniqueID": "T1208",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1562.002",
-            "score": 3,
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1004",
+            "techniqueID": "T1585",
             "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1595.002",
+            "techniqueID": "T1558.003",
             "score": 2,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml"
         },
         {
-            "techniqueID": "T1547.004",
-            "score": 3,
+            "techniqueID": "T1094",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1482",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+            "techniqueID": "T1596.003",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1583.003",
-            "score": 3,
+            "techniqueID": "T1561.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1550.003",
-            "score": 3,
+            "techniqueID": "T1014",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1074",
+            "techniqueID": "T1114",
             "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml"
+        },
+        {
+            "techniqueID": "T1588.004",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1104",
-            "score": 3,
+            "techniqueID": "T1093",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1072",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml"
+            "techniqueID": "T1587.003",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1593",
-            "score": 3,
+            "techniqueID": "T1110.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1097",
-            "score": 3,
+            "techniqueID": "T1586.001",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1201",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml"
+            "techniqueID": "T1487",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1573",
-            "score": 3,
+            "techniqueID": "T1091",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589.001",
-            "score": 2,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
+            "techniqueID": "T1589",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.003",
-            "score": -4,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "techniqueID": "T1145",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1027.004",
-            "score": 3,
+            "techniqueID": "T1552.004",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1500",
-            "score": 3,
+            "techniqueID": "T1003.005",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1555.004",
-            "score": 3,
+            "techniqueID": "T1036.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1485",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml"
+            "techniqueID": "T1497",
+            "score": 4,
+            "showSubtechniques": false
         },
         {
-            "techniqueID": "T1498",
-            "score": 3,
+            "techniqueID": "T1071.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1098.002",
+            "techniqueID": "T1199",
             "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1588.002",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1588.003",
-            "score": 3,
+            "techniqueID": "T1585.001",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1003.006",
-            "score": 3,
+            "techniqueID": "T1055.012",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1053.002",
-            "score": 3,
+            "techniqueID": "T1208",
+            "score": 4,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1529",
+            "techniqueID": "T1486",
+            "score": -2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml"
+        },
+        {
+            "techniqueID": "T1197",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml"
+        },
+        {
+            "techniqueID": "T1496",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1585",
             "score": 3,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml"
+        },
+        {
+            "techniqueID": "T1008",
+            "score": 4,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1558.003",
+            "score": 2,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml"
+        },
+        {
+            "techniqueID": "T1094",
+            "score": 4,
             "showSubtechniques": false
         },
         {
@@ -449435,7 +449728,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -449637,7 +449930,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -449839,7 +450132,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -450041,7 +450334,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -450243,7 +450536,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -450445,7 +450738,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -450647,7 +450940,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -450849,7 +451142,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -451051,7 +451344,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -451253,7 +451546,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -451455,7 +451748,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -451657,7 +451950,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -451859,7 +452152,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -452061,7 +452354,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -452263,7 +452556,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -452465,7 +452758,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -452667,7 +452960,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -452869,7 +453162,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453071,7 +453364,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453273,7 +453566,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453475,7 +453768,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453677,7 +453970,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -453879,7 +454172,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454081,7 +454374,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454283,7 +454576,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454485,7 +454778,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454687,7 +454980,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -454889,7 +455182,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455091,7 +455384,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455293,7 +455586,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455495,7 +455788,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455697,7 +455990,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -455899,7 +456192,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456101,7 +456394,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456303,7 +456596,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456505,7 +456798,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456707,7 +457000,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -456909,7 +457202,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457111,7 +457404,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457313,7 +457606,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457515,7 +457808,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457717,7 +458010,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -457919,7 +458212,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458121,7 +458414,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458323,7 +458616,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458525,7 +458818,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458727,7 +459020,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -458929,7 +459222,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -459131,7 +459424,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -459333,7 +459626,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -459535,7 +459828,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -459737,7 +460030,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -459939,7 +460232,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460141,7 +460434,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460343,7 +460636,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460545,7 +460838,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460747,7 +461040,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -460949,7 +461242,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461151,7 +461444,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461353,7 +461646,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461555,7 +461848,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461757,7 +462050,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -461959,7 +462252,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462161,7 +462454,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462363,7 +462656,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462565,7 +462858,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462767,7 +463060,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -462969,7 +463262,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463171,7 +463464,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463373,7 +463666,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463575,7 +463868,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463777,7 +464070,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -463979,7 +464272,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464181,7 +464474,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464383,7 +464676,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464585,7 +464878,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464787,7 +465080,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -464989,7 +465282,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465191,7 +465484,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465393,7 +465686,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465595,7 +465888,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465797,7 +466090,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -465999,7 +466292,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -466201,7 +466494,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -466403,7 +466696,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -466605,7 +466898,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -466807,7 +467100,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467009,7 +467302,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467211,7 +467504,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467413,7 +467706,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467615,7 +467908,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -467817,7 +468110,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468019,7 +468312,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468221,7 +468514,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468423,7 +468716,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468625,7 +468918,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -468827,7 +469120,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469029,7 +469322,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469231,7 +469524,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469433,7 +469726,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469635,7 +469928,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -469837,7 +470130,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470039,7 +470332,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470241,7 +470534,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470443,7 +470736,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470645,7 +470938,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -470847,7 +471140,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471049,7 +471342,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471251,7 +471544,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471453,7 +471746,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471655,7 +471948,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -471857,7 +472150,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -472059,7 +472352,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -472261,7 +472554,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -472463,7 +472756,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -472665,7 +472958,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -472867,7 +473160,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473069,7 +473362,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473271,7 +473564,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473473,7 +473766,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473675,7 +473968,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -473877,7 +474170,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474079,7 +474372,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474281,7 +474574,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474483,7 +474776,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474685,7 +474978,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -474887,7 +475180,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475089,7 +475382,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475291,7 +475584,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475493,7 +475786,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475695,7 +475988,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -475897,7 +476190,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476099,7 +476392,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476301,7 +476594,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476503,7 +476796,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476705,7 +476998,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -476907,7 +477200,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477109,7 +477402,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477311,7 +477604,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477513,7 +477806,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477715,7 +478008,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -477917,7 +478210,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478119,7 +478412,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478321,7 +478614,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478523,7 +478816,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478725,7 +479018,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -478927,7 +479220,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479129,7 +479422,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479331,7 +479624,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479533,7 +479826,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479735,7 +480028,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -479937,7 +480230,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480139,7 +480432,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480341,7 +480634,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480543,7 +480836,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480745,7 +481038,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -480947,7 +481240,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481149,7 +481442,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481351,7 +481644,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481553,7 +481846,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481755,7 +482048,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -481957,7 +482250,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482159,7 +482452,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482361,7 +482654,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482563,7 +482856,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482765,7 +483058,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -482967,7 +483260,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483169,7 +483462,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483371,7 +483664,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483573,7 +483866,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483775,7 +484068,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -483977,7 +484270,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484179,7 +484472,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484381,7 +484674,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484583,7 +484876,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484785,7 +485078,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -484987,7 +485280,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485189,7 +485482,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485391,7 +485684,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485593,7 +485886,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485795,7 +486088,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -485997,7 +486290,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -486199,7 +486492,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -486401,7 +486694,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -486603,7 +486896,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -486805,7 +487098,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487007,7 +487300,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487209,7 +487502,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487411,7 +487704,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487613,7 +487906,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -487815,7 +488108,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488017,7 +488310,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488219,7 +488512,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488421,7 +488714,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488623,7 +488916,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -488825,7 +489118,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489027,7 +489320,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489229,7 +489522,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489431,7 +489724,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489633,7 +489926,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -489835,7 +490128,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490037,7 +490330,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490239,7 +490532,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490441,7 +490734,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490643,7 +490936,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -490845,7 +491138,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491047,7 +491340,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491249,7 +491542,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491451,7 +491744,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491653,7 +491946,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -491855,7 +492148,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492057,7 +492350,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492259,7 +492552,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492461,7 +492754,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492663,7 +492956,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -492865,7 +493158,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493067,7 +493360,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493269,7 +493562,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493471,7 +493764,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493673,7 +493966,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -493875,7 +494168,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494077,7 +494370,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494279,7 +494572,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494481,7 +494774,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494683,7 +494976,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -494885,7 +495178,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495087,7 +495380,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495289,7 +495582,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495491,7 +495784,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495693,7 +495986,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -495895,7 +496188,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496097,7 +496390,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496299,7 +496592,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496501,7 +496794,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496703,7 +496996,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -496905,7 +497198,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497107,7 +497400,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497309,7 +497602,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497511,7 +497804,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497713,7 +498006,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -497915,7 +498208,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498117,7 +498410,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498319,7 +498612,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498521,7 +498814,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498723,7 +499016,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -498925,7 +499218,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -499127,7 +499420,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -499329,7 +499622,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -499531,7 +499824,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -499733,7 +500026,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -499935,7 +500228,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500137,7 +500430,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500339,7 +500632,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500541,7 +500834,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500743,7 +501036,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -500945,7 +501238,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501147,7 +501440,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501349,7 +501642,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501551,7 +501844,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501753,7 +502046,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -501955,7 +502248,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502157,7 +502450,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502359,7 +502652,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502561,7 +502854,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502763,7 +503056,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -502965,7 +503258,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503167,7 +503460,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503369,7 +503662,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503571,7 +503864,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503773,7 +504066,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -503975,7 +504268,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504177,7 +504470,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504379,7 +504672,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504581,7 +504874,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504783,7 +505076,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -504985,7 +505278,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505187,7 +505480,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505389,7 +505682,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505591,7 +505884,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505793,7 +506086,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -505995,7 +506288,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -506197,7 +506490,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -506399,7 +506692,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -506601,7 +506894,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -506803,7 +507096,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507005,7 +507298,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507207,7 +507500,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507409,7 +507702,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507611,7 +507904,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -507813,7 +508106,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508015,7 +508308,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508217,7 +508510,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508419,7 +508712,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508621,7 +508914,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -508823,7 +509116,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509025,7 +509318,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509227,7 +509520,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509429,7 +509722,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509631,7 +509924,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -509833,7 +510126,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510035,7 +510328,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510237,7 +510530,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510439,7 +510732,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510641,7 +510934,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -510843,7 +511136,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511045,7 +511338,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511247,7 +511540,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511449,7 +511742,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511651,7 +511944,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -511853,7 +512146,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512055,7 +512348,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512257,7 +512550,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512459,7 +512752,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512661,7 +512954,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -512863,7 +513156,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -513065,7 +513358,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -513267,7 +513560,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -513469,7 +513762,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -513671,7 +513964,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -513873,7 +514166,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514075,7 +514368,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514277,7 +514570,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514479,7 +514772,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514681,7 +514974,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -514883,7 +515176,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515085,7 +515378,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515287,7 +515580,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515489,7 +515782,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515691,7 +515984,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -515893,7 +516186,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516095,7 +516388,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516297,7 +516590,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516499,7 +516792,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516701,7 +516994,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -516903,7 +517196,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517105,7 +517398,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517307,7 +517600,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517509,7 +517802,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517711,7 +518004,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -517913,7 +518206,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518115,7 +518408,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518317,7 +518610,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518519,7 +518812,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518721,7 +519014,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -518923,7 +519216,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519125,7 +519418,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519327,7 +519620,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519529,7 +519822,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519731,7 +520024,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -519933,7 +520226,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520135,7 +520428,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520337,7 +520630,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520539,7 +520832,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520741,7 +521034,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -520943,7 +521236,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521145,7 +521438,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521347,7 +521640,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521549,7 +521842,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521751,7 +522044,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -521953,7 +522246,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -522155,7 +522448,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -522357,7 +522650,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -522559,7 +522852,7 @@
             "techniqueID": "T1036.003",
             "score": -4,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
             "techniqueID": "T1027.004",
@@ -522613,13797 +522906,811 @@
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1191",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1565.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
-            "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
+            "techniqueID": "T1067",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1555.005",
-            "score": 2,
+            "techniqueID": "T1557",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1608.004",
-            "score": 2,
+            "techniqueID": "T1213.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1176",
-            "score": 2,
+            "techniqueID": "T1016.001",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1560.002",
-            "score": 2,
+            "techniqueID": "T1542.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1032",
-            "score": 2,
+            "techniqueID": "T1025",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1087.003",
-            "score": 2,
+            "techniqueID": "T1114.001",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1218.003",
-            "score": 2,
+            "techniqueID": "T1080",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1483",
-            "score": 2,
+            "techniqueID": "T1497.001",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1553.006",
-            "score": 2,
+            "techniqueID": "T1115",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1217",
-            "score": 2,
+            "techniqueID": "T1587.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1574.006",
-            "score": 2,
+            "techniqueID": "T1584.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1134.002",
-            "score": 2,
+            "techniqueID": "T1567",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1125",
-            "score": 2,
+            "techniqueID": "T1562.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1589.003",
-            "score": 2,
+            "techniqueID": "T1004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1542.002",
+            "techniqueID": "T1595.002",
             "score": 2,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1191",
-            "score": 2,
+            "techniqueID": "T1547.004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114.003",
+            "techniqueID": "T1482",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1109",
-            "score": 2,
+            "techniqueID": "T1583.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568.002",
-            "score": 2,
+            "techniqueID": "T1550.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1594",
-            "score": 2,
+            "techniqueID": "T1074",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1565.001",
-            "score": 2,
+            "techniqueID": "T1104",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1606.002",
+            "techniqueID": "T1072",
             "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml"
         },
         {
-            "techniqueID": "T1589.003",
-            "score": 2,
+            "techniqueID": "T1593",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1542.002",
-            "score": 2,
+            "techniqueID": "T1097",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1191",
+            "techniqueID": "T1201",
             "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1114.003",
-            "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1109",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1594",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml"
         },
         {
-            "techniqueID": "T1565.001",
-            "score": 2,
+            "techniqueID": "T1573",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1606.002",
+            "techniqueID": "T1589.001",
             "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
         },
         {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
-            "techniqueID": "T1589.003",
-            "score": 2,
+            "techniqueID": "T1027.004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1542.002",
-            "score": 2,
+            "techniqueID": "T1500",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1191",
-            "score": 2,
+            "techniqueID": "T1555.004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114.003",
+            "techniqueID": "T1485",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml"
         },
         {
-            "techniqueID": "T1497.002",
-            "score": 2,
+            "techniqueID": "T1498",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1052.001",
-            "score": 2,
+            "techniqueID": "T1098.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1059.004",
-            "score": 2,
+            "techniqueID": "T1588.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.001",
-            "score": 2,
+            "techniqueID": "T1003.006",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1187",
-            "score": 2,
+            "techniqueID": "T1053.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1001.003",
-            "score": 2,
+            "techniqueID": "T1529",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1550.004",
-            "score": 2,
+            "techniqueID": "T1067",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1506",
-            "score": 2,
+            "techniqueID": "T1557",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1111",
-            "score": 2,
+            "techniqueID": "T1213.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1564.005",
-            "score": 2,
+            "techniqueID": "T1016.001",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1037.001",
-            "score": 2,
+            "techniqueID": "T1542.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1220",
-            "score": 2,
+            "techniqueID": "T1025",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1480.001",
-            "score": 2,
+            "techniqueID": "T1114.001",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1118",
-            "score": 2,
+            "techniqueID": "T1080",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1021.005",
-            "score": 2,
+            "techniqueID": "T1497.001",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1222.002",
-            "score": 2,
+            "techniqueID": "T1115",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1492",
-            "score": 2,
+            "techniqueID": "T1587.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1109",
-            "score": 2,
+            "techniqueID": "T1584.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568.002",
-            "score": 2,
+            "techniqueID": "T1567",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1594",
-            "score": 2,
+            "techniqueID": "T1562.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1565.001",
-            "score": 2,
+            "techniqueID": "T1004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1606.002",
+            "techniqueID": "T1595.002",
             "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1191",
-            "score": 2,
+            "techniqueID": "T1547.004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114.003",
+            "techniqueID": "T1482",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1109",
-            "score": 2,
+            "techniqueID": "T1583.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568.002",
-            "score": 2,
+            "techniqueID": "T1550.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1594",
-            "score": 2,
+            "techniqueID": "T1074",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1565.001",
-            "score": 2,
+            "techniqueID": "T1104",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1606.002",
+            "techniqueID": "T1072",
             "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml"
         },
         {
-            "techniqueID": "T1483",
-            "score": 2,
+            "techniqueID": "T1593",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1553.006",
-            "score": 2,
+            "techniqueID": "T1097",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1217",
+            "techniqueID": "T1201",
             "score": 2,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml"
         },
         {
-            "techniqueID": "T1574.006",
-            "score": 2,
+            "techniqueID": "T1573",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1134.002",
+            "techniqueID": "T1589.001",
             "score": 2,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
         },
         {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
-            "techniqueID": "T1589.003",
-            "score": 2,
+            "techniqueID": "T1027.004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1542.002",
-            "score": 2,
+            "techniqueID": "T1500",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1191",
-            "score": 2,
+            "techniqueID": "T1555.004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114.003",
+            "techniqueID": "T1485",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml"
         },
         {
-            "techniqueID": "T1497.002",
-            "score": 2,
+            "techniqueID": "T1498",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1052.001",
-            "score": 2,
+            "techniqueID": "T1098.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1059.004",
-            "score": 2,
+            "techniqueID": "T1588.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.001",
-            "score": 2,
+            "techniqueID": "T1003.006",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1187",
-            "score": 2,
+            "techniqueID": "T1053.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1001.003",
-            "score": 2,
+            "techniqueID": "T1529",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1550.004",
-            "score": 2,
+            "techniqueID": "T1067",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1506",
-            "score": 2,
+            "techniqueID": "T1557",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1111",
-            "score": 2,
+            "techniqueID": "T1213.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1564.005",
-            "score": 2,
+            "techniqueID": "T1016.001",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1037.001",
-            "score": 2,
+            "techniqueID": "T1542.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1220",
-            "score": 2,
+            "techniqueID": "T1025",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1480.001",
-            "score": 2,
+            "techniqueID": "T1114.001",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1118",
-            "score": 2,
+            "techniqueID": "T1080",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1021.005",
-            "score": 2,
+            "techniqueID": "T1497.001",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1222.002",
-            "score": 2,
+            "techniqueID": "T1115",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1492",
-            "score": 2,
+            "techniqueID": "T1587.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1109",
-            "score": 2,
+            "techniqueID": "T1584.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568.002",
-            "score": 2,
+            "techniqueID": "T1567",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1594",
-            "score": 2,
+            "techniqueID": "T1562.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1565.001",
-            "score": 2,
+            "techniqueID": "T1004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1606.002",
+            "techniqueID": "T1595.002",
             "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1191",
-            "score": 2,
+            "techniqueID": "T1547.004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114.003",
+            "techniqueID": "T1482",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1109",
-            "score": 2,
+            "techniqueID": "T1583.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568.002",
-            "score": 2,
+            "techniqueID": "T1550.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1594",
-            "score": 2,
+            "techniqueID": "T1074",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1565.001",
-            "score": 2,
+            "techniqueID": "T1104",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1606.002",
+            "techniqueID": "T1072",
             "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml"
         },
         {
-            "techniqueID": "T1483",
-            "score": 2,
+            "techniqueID": "T1593",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1553.006",
-            "score": 2,
+            "techniqueID": "T1097",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1217",
+            "techniqueID": "T1201",
             "score": 2,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml"
         },
         {
-            "techniqueID": "T1574.006",
-            "score": 2,
+            "techniqueID": "T1573",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1134.002",
+            "techniqueID": "T1589.001",
             "score": 2,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
         },
         {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
-            "techniqueID": "T1589.003",
-            "score": 2,
+            "techniqueID": "T1027.004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1542.002",
-            "score": 2,
+            "techniqueID": "T1500",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1191",
-            "score": 2,
+            "techniqueID": "T1555.004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114.003",
+            "techniqueID": "T1485",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml"
         },
         {
-            "techniqueID": "T1497.002",
-            "score": 2,
+            "techniqueID": "T1498",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1052.001",
-            "score": 2,
+            "techniqueID": "T1098.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1059.004",
-            "score": 2,
+            "techniqueID": "T1588.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1036.001",
-            "score": 2,
+            "techniqueID": "T1003.006",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1187",
-            "score": 2,
+            "techniqueID": "T1053.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1001.003",
-            "score": 2,
+            "techniqueID": "T1529",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1550.004",
-            "score": 2,
+            "techniqueID": "T1067",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1506",
-            "score": 2,
+            "techniqueID": "T1557",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1111",
-            "score": 2,
+            "techniqueID": "T1213.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1564.005",
-            "score": 2,
+            "techniqueID": "T1016.001",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1037.001",
-            "score": 2,
+            "techniqueID": "T1542.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1220",
-            "score": 2,
+            "techniqueID": "T1025",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1480.001",
-            "score": 2,
+            "techniqueID": "T1114.001",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1118",
-            "score": 2,
+            "techniqueID": "T1080",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1021.005",
-            "score": 2,
+            "techniqueID": "T1497.001",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1222.002",
-            "score": 2,
+            "techniqueID": "T1115",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1492",
-            "score": 2,
+            "techniqueID": "T1587.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1109",
-            "score": 2,
+            "techniqueID": "T1584.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568.002",
-            "score": 2,
+            "techniqueID": "T1567",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1594",
-            "score": 2,
+            "techniqueID": "T1562.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1565.001",
-            "score": 2,
+            "techniqueID": "T1004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1606.002",
+            "techniqueID": "T1595.002",
             "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1483",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1553.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1217",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1574.006",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1134.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1589.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1542.002",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1191",
-            "score": 2,
+            "techniqueID": "T1547.004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114.003",
+            "techniqueID": "T1482",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1111",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1564.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1037.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1220",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1480.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1118",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1021.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1222.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1492",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml"
         },
         {
-            "techniqueID": "T1109",
-            "score": 2,
+            "techniqueID": "T1583.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1568.002",
-            "score": 2,
+            "techniqueID": "T1550.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1594",
-            "score": 2,
+            "techniqueID": "T1074",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1565.001",
-            "score": 2,
+            "techniqueID": "T1104",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1606.002",
+            "techniqueID": "T1072",
             "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1489",
-            "score": 1,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
-        },
-        {
-            "techniqueID": "T1484.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1568.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1559.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1555.005",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1608.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1176",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1560.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1032",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1087.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml"
         },
         {
-            "techniqueID": "T1483",
-            "score": 2,
+            "techniqueID": "T1593",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1553.006",
-            "score": 2,
+            "techniqueID": "T1097",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1217",
+            "techniqueID": "T1201",
             "score": 2,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml"
         },
         {
-            "techniqueID": "T1574.006",
-            "score": 2,
+            "techniqueID": "T1573",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1134.002",
+            "techniqueID": "T1589.001",
             "score": 2,
-            "showSubtechniques": false
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml"
         },
         {
-            "techniqueID": "T1125",
-            "score": 2,
-            "showSubtechniques": false
+            "techniqueID": "T1036.003",
+            "score": -4,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml"
         },
         {
-            "techniqueID": "T1589.003",
-            "score": 2,
+            "techniqueID": "T1027.004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1542.002",
-            "score": 2,
+            "techniqueID": "T1500",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1191",
-            "score": 2,
+            "techniqueID": "T1555.004",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1114.003",
+            "techniqueID": "T1485",
             "score": 0,
             "showSubtechniques": false,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
-        },
-        {
-            "techniqueID": "T1055.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1606.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1098.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1048.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1497.002",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1052.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1059.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1036.001",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1187",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1001.003",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1550.004",
-            "score": 2,
-            "showSubtechniques": false
-        },
-        {
-            "techniqueID": "T1506",
-            "score": 2,
-            "showSubtechniques": false
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml"
         },
         {
-            "techniqueID": "T1111",
-            "score": 2,
+            "techniqueID": "T1498",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1564.005",
-            "score": 2,
+            "techniqueID": "T1098.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1037.001",
-            "score": 2,
+            "techniqueID": "T1588.003",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1220",
-            "score": 2,
+            "techniqueID": "T1003.006",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1480.001",
-            "score": 2,
+            "techniqueID": "T1053.002",
+            "score": 3,
             "showSubtechniques": false
         },
         {
-            "techniqueID": "T1118",
-            "score": 2,
+            "techniqueID": "T1529",
+            "score": 3,
             "showSubtechniques": false
         },
         {
@@ -536504,8 +523811,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -536746,8 +524054,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -536988,8 +524297,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -537230,8 +524540,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -537472,8 +524783,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -537714,8 +525026,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -537956,9 +525269,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -538198,8 +525755,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -538440,8 +525998,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -538682,8 +526241,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -538924,8 +526484,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -539166,9 +526727,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -539408,8 +527213,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -539650,8 +527456,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -539892,8 +527699,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -540134,8 +527942,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -540376,9 +528185,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -540618,8 +528671,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -540860,8 +528914,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -541102,8 +529157,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -541344,8 +529400,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -541586,9 +529643,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -541828,8 +530129,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -542070,8 +530372,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -542312,8 +530615,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -542554,8 +530858,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -542796,9 +531101,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -543038,8 +531587,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -543280,8 +531830,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -543522,8 +532073,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -543764,8 +532316,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -544006,9 +532559,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -544248,8 +533045,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -544490,8 +533288,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -544732,8 +533531,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -544974,8 +533774,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -545216,9 +534017,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -545458,8 +534503,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -545700,8 +534746,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -545942,8 +534989,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -546184,8 +535232,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -546426,9 +535475,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -546668,8 +535961,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -546910,8 +536204,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -547152,8 +536447,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -547394,8 +536690,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -547636,9 +536933,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -547878,8 +537419,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -548120,8 +537662,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -548362,8 +537905,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -548604,8 +538148,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -548846,9 +538391,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -549088,8 +538877,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -549330,8 +539120,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -549572,8 +539363,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -549814,8 +539606,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -550056,9 +539849,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -550298,8 +540335,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -550540,8 +540578,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -550782,8 +540821,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -551024,8 +541064,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -551266,9 +541307,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -551508,8 +541793,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -551750,8 +542036,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -551992,8 +542279,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -552234,8 +542522,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -552476,9 +542765,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -552718,8 +543251,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -552960,8 +543494,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -553202,8 +543737,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -553444,8 +543980,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -553686,9 +544223,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -553928,8 +544709,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -554170,8 +544952,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -554412,8 +545195,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -554654,8 +545438,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -554896,9 +545681,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -555138,8 +546167,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -555380,8 +546410,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -555622,8 +546653,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -555864,8 +546896,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -556106,9 +547139,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -556348,8 +547625,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -556590,8 +547868,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -556832,8 +548111,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -557074,8 +548354,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -557316,9 +548597,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -557558,8 +549083,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -557800,8 +549326,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -558042,8 +549569,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -558284,8 +549812,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -558526,9 +550055,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -558768,8 +550541,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -559010,8 +550784,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -559252,8 +551027,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -559494,8 +551270,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -559736,9 +551513,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -559978,8 +551999,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -560220,8 +552242,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -560462,8 +552485,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -560704,8 +552728,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -560946,9 +552971,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -561188,8 +553457,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -561430,8 +553700,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -561672,8 +553943,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -561914,8 +554186,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -562156,9 +554429,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -562398,8 +554915,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -562640,8 +555158,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -562882,8 +555401,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -563124,8 +555644,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -563366,9 +555887,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -563608,8 +556373,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -563850,8 +556616,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -564092,8 +556859,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -564334,8 +557102,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -564576,9 +557345,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -564818,8 +557831,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -565060,8 +558074,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -565302,8 +558317,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -565544,8 +558560,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -565786,9 +558803,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -566028,8 +559289,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -566270,8 +559532,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -566512,8 +559775,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -566754,8 +560018,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -566996,9 +560261,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -567238,8 +560747,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -567480,8 +560990,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -567722,8 +561233,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -567964,8 +561476,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -568206,9 +561719,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -568448,8 +562205,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -568690,8 +562448,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -568932,8 +562691,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -569174,8 +562934,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -569416,9 +563177,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -569658,8 +563663,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -569900,8 +563906,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -570142,8 +564149,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -570384,8 +564392,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -570626,9 +564635,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -570868,8 +565121,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -571110,8 +565364,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -571352,8 +565607,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -571594,8 +565850,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -571836,9 +566093,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -572078,8 +566579,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -572320,8 +566822,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -572562,8 +567065,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -572804,8 +567308,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -573046,9 +567551,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -573288,8 +568037,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -573530,8 +568280,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -573772,8 +568523,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -574014,8 +568766,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -574256,9 +569009,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -574498,8 +569495,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -574740,8 +569738,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -574982,8 +569981,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -575224,8 +570224,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -575466,9 +570467,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -575708,8 +570953,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -575950,8 +571196,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -576192,8 +571439,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -576434,8 +571682,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -576676,9 +571925,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -576918,8 +572411,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -577160,8 +572654,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -577402,8 +572897,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -577644,8 +573140,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -577886,9 +573383,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -578128,8 +573869,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -578370,8 +574112,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -578612,8 +574355,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -578854,8 +574598,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -579096,9 +574841,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -579338,8 +575327,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -579580,8 +575570,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -579822,8 +575813,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -580064,8 +576056,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -580306,9 +576299,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -580548,8 +576785,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -580790,8 +577028,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -581032,8 +577271,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -581274,8 +577514,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -581516,9 +577757,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -581758,8 +578243,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -582000,8 +578486,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -582242,8 +578729,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -582484,8 +578972,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -582726,9 +579215,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -582968,8 +579701,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -583210,8 +579944,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -583452,8 +580187,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -583694,8 +580430,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -583936,9 +580673,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -584178,8 +581159,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -584420,8 +581402,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -584662,8 +581645,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -584904,8 +581888,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -585146,9 +582131,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -585388,8 +582617,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -585630,8 +582860,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -585872,8 +583103,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -586114,8 +583346,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -586356,9 +583589,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -586598,8 +584075,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -586840,8 +584318,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -587082,8 +584561,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -587324,8 +584804,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -587566,9 +585047,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -587808,8 +585533,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -588050,8 +585776,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -588292,8 +586019,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -588534,8 +586262,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -588776,9 +586505,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -589018,8 +586991,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -589260,8 +587234,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -589502,8 +587477,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -589744,8 +587720,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -589986,9 +587963,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -590228,8 +588449,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -590470,8 +588692,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -590712,8 +588935,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -590954,8 +589178,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -591196,9 +589421,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -591438,8 +589907,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -591680,8 +590150,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -591922,8 +590393,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -592164,8 +590636,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -592406,9 +590879,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -592648,8 +591365,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -592890,8 +591608,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -593132,8 +591851,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -593374,8 +592094,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -593616,9 +592337,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -593858,8 +592823,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -594100,8 +593066,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -594342,8 +593309,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -594584,8 +593552,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -594826,9 +593795,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -595068,8 +594281,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -595310,8 +594524,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -595552,8 +594767,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -595794,8 +595010,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -596036,9 +595253,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -596278,8 +595739,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -596520,8 +595982,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -596762,8 +596225,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -597004,8 +596468,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -597246,9 +596711,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -597488,8 +597197,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -597730,8 +597440,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -597972,8 +597683,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -598214,8 +597926,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -598456,9 +598169,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -598698,8 +598655,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -598940,8 +598898,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -599182,8 +599141,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -599424,8 +599384,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -599666,9 +599627,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -599908,8 +600113,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -600150,8 +600356,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -600392,8 +600599,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -600634,8 +600842,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -600876,9 +601085,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -601118,8 +601571,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -601360,8 +601814,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -601602,8 +602057,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -601844,8 +602300,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -602086,9 +602543,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -602328,8 +603029,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -602570,8 +603272,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -602812,8 +603515,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -603054,8 +603758,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -603296,9 +604001,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -603538,8 +604487,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -603780,8 +604730,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -604022,8 +604973,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -604264,8 +605216,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -604506,9 +605459,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -604748,8 +605945,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -604990,8 +606188,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -605232,8 +606431,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -605474,8 +606674,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -605716,9 +606917,253 @@
         },
         {
             "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
+        {
+            "techniqueID": "T1483",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1553.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1217",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1574.006",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1134.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1125",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1589.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1542.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1191",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1114.003",
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml"
+        },
+        {
+            "techniqueID": "T1055.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1048.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1497.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1052.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1059.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1036.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1187",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1001.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1550.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1506",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1111",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1564.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1037.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1220",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1480.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1118",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1021.005",
             "score": 2,
             "showSubtechniques": false
         },
+        {
+            "techniqueID": "T1222.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1492",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1109",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1594",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1565.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1606.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1489",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1568.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1559.001",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1555.005",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1608.004",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1176",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1560.002",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1032",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1087.003",
+            "score": 2,
+            "showSubtechniques": false
+        },
+        {
+            "techniqueID": "T1218.003",
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
+        },
         {
             "techniqueID": "T1483",
             "score": 2,
@@ -605958,8 +607403,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -606200,8 +607646,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -606442,8 +607889,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -606684,8 +608132,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -606926,8 +608375,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -607168,8 +608618,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -607410,8 +608861,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -607652,8 +609104,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -607894,8 +609347,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -608136,8 +609590,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -608378,8 +609833,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -608620,8 +610076,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -608862,8 +610319,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -609104,8 +610562,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -609346,8 +610805,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -609588,8 +611048,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -609830,8 +611291,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -610072,8 +611534,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -610314,8 +611777,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -610556,8 +612020,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -610798,8 +612263,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -611040,8 +612506,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -611282,8 +612749,9 @@
         },
         {
             "techniqueID": "T1218.003",
-            "score": 2,
-            "showSubtechniques": false
+            "score": 1,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml"
         },
         {
             "techniqueID": "T1483",
@@ -611443,8 +612911,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -611909,8 +613378,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -612375,8 +613845,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -612841,8 +614312,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -613307,8 +614779,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -613773,8 +615246,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -614239,8 +615713,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -614705,8 +616180,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -615171,8 +616647,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -615637,8 +617114,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -616103,8 +617581,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -616569,8 +618048,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -617035,8 +618515,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -617501,8 +618982,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -617967,8 +619449,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -618433,8 +619916,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -618899,8 +620383,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -619365,8 +620850,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -619831,8 +621317,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -620297,8 +621784,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -620763,8 +622251,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -621229,8 +622718,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -621695,8 +623185,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -622161,8 +623652,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -622627,8 +624119,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -623093,8 +624586,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -623559,8 +625053,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -624025,8 +625520,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -624491,8 +625987,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -624957,8 +626454,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -625423,8 +626921,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -625889,8 +627388,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -626355,8 +627855,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -626821,8 +628322,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -627287,8 +628789,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -627753,8 +629256,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -628219,8 +629723,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -628685,8 +630190,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -629151,8 +630657,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -629617,8 +631124,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -630083,8 +631591,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -630549,8 +632058,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -631015,8 +632525,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -631481,8 +632992,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -631947,8 +633459,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -632413,8 +633926,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -632879,8 +634393,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -633345,8 +634860,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -633811,8 +635327,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -634277,8 +635794,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -634743,8 +636261,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -635209,8 +636728,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -635675,8 +637195,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -636141,8 +637662,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -636607,8 +638129,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -637073,8 +638596,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -637539,8 +639063,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -638005,8 +639530,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -638471,8 +639997,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -638937,8 +640464,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -639403,8 +640931,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -639869,8 +641398,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -640335,8 +641865,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -640801,8 +642332,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -641267,8 +642799,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -641733,8 +643266,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -642199,8 +643733,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -642665,8 +644200,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -643131,8 +644667,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -643597,8 +645134,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -644063,8 +645601,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -644529,8 +646068,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -644995,8 +646535,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -645461,8 +647002,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -645927,8 +647469,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -646393,8 +647936,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -646859,8 +648403,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -647325,8 +648870,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -647791,8 +649337,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -648257,8 +649804,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -648723,8 +650271,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -649189,8 +650738,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -649655,8 +651205,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -650121,8 +651672,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -650587,8 +652139,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -651053,8 +652606,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -651519,8 +653073,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -651985,8 +653540,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -652451,8 +654007,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -652917,8 +654474,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -653383,8 +654941,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -653849,8 +655408,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -654315,8 +655875,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -654781,8 +656342,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -655247,8 +656809,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -655713,8 +657276,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -656179,8 +657743,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -656645,8 +658210,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -657111,8 +658677,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -657577,8 +659144,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -658043,8 +659611,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -658509,8 +660078,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -658975,8 +660545,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -659441,8 +661012,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -659907,8 +661479,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -660373,8 +661946,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -660839,8 +662413,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -661305,8 +662880,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -661771,8 +663347,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -662237,8 +663814,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -662703,8 +664281,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -663169,8 +664748,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -663635,8 +665215,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -664101,8 +665682,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -664567,8 +666149,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -665033,8 +666616,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -665499,8 +667083,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -665965,8 +667550,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -666431,8 +668017,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -666897,8 +668484,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -667363,8 +668951,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -667829,8 +669418,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -668295,8 +669885,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -668761,8 +670352,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -669227,8 +670819,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -669693,8 +671286,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -670159,8 +671753,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -670625,8 +672220,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -671091,8 +672687,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -671557,8 +673154,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -672023,8 +673621,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -672489,8 +674088,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -672955,8 +674555,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -673421,8 +675022,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -673887,8 +675489,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -674353,8 +675956,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -674819,8 +676423,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -675285,8 +676890,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -675751,8 +677357,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -676217,8 +677824,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -676683,8 +678291,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -677149,8 +678758,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -677615,8 +679225,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -678081,8 +679692,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -678547,8 +680159,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -679013,8 +680626,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -679479,8 +681093,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -679945,8 +681560,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -680411,8 +682027,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -680877,8 +682494,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -681343,8 +682961,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -681809,8 +683428,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -682275,8 +683895,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -682741,8 +684362,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -683207,8 +684829,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -683673,8 +685296,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -684139,8 +685763,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -684605,8 +686230,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -685071,8 +686697,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -685537,8 +687164,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -686003,8 +687631,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -686469,8 +688098,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -686935,8 +688565,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -687401,8 +689032,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -687867,8 +689499,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -688333,8 +689966,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -688799,8 +690433,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -689265,8 +690900,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -689731,8 +691367,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -690197,8 +691834,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -690663,8 +692301,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -691129,8 +692768,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -691595,8 +693235,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -692061,8 +693702,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -692527,8 +694169,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -692993,8 +694636,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -693459,8 +695103,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -693925,8 +695570,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -694391,8 +696037,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -694857,8 +696504,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -695323,8 +696971,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -695789,8 +697438,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -696255,8 +697905,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -696721,8 +698372,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -697187,8 +698839,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -697653,8 +699306,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -698119,8 +699773,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -698585,8 +700240,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -699051,8 +700707,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -699517,8 +701174,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -699983,8 +701641,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -700449,8 +702108,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -700915,8 +702575,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -701381,8 +703042,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -701847,8 +703509,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -702313,8 +703976,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -702779,8 +704443,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -703245,8 +704910,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -703711,8 +705377,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -704177,8 +705844,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -704643,8 +706311,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -705109,8 +706778,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -705575,8 +707245,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -706041,8 +707712,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -706507,8 +708179,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -706973,8 +708646,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -707439,8 +709113,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -707905,8 +709580,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -708371,8 +710047,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -708837,8 +710514,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -709303,8 +710981,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -709769,8 +711448,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -710235,8 +711915,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -710701,8 +712382,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -711167,8 +712849,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -711633,8 +713316,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -712099,8 +713783,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -712565,8 +714250,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -713031,8 +714717,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -713497,8 +715184,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -713963,8 +715651,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -714429,8 +716118,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -714895,8 +716585,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -715361,8 +717052,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -715827,8 +717519,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -716293,8 +717986,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -716759,8 +718453,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -717225,8 +718920,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -717691,8 +719387,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -718157,8 +719854,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -718623,8 +720321,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -719089,8 +720788,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -719555,8 +721255,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -720021,8 +721722,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -720487,8 +722189,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -720953,8 +722656,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -721419,8 +723123,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -721885,8 +723590,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -722351,8 +724057,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -722817,8 +724524,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -723283,8 +724991,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -723749,8 +725458,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -724215,8 +725925,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -724681,8 +726392,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -725147,8 +726859,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -725613,8 +727326,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -726079,8 +727793,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -726545,8 +728260,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -727011,8 +728727,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -727477,8 +729194,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -727943,8 +729661,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -728409,8 +730128,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -728875,8 +730595,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -729341,8 +731062,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -729807,8 +731529,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -730273,8 +731996,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -730739,8 +732463,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -731205,8 +732930,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -731671,8 +733397,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -732137,8 +733864,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -732603,8 +734331,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -733069,8 +734798,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -733535,8 +735265,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -734001,8 +735732,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -734467,8 +736199,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -734933,8 +736666,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -735399,8 +737133,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -735865,8 +737600,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -736331,8 +738067,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -736797,8 +738534,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -737263,8 +739001,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -737729,8 +739468,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -738195,8 +739935,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -738661,8 +740402,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -739127,8 +740869,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -739593,8 +741336,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -740059,8 +741803,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -740525,8 +742270,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -740991,8 +742737,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -741457,8 +743204,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -741923,8 +743671,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -742389,8 +744138,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -742855,8 +744605,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -743321,8 +745072,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -743787,8 +745539,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -744253,8 +746006,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -744719,8 +746473,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -745185,8 +746940,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -745651,8 +747407,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -746117,8 +747874,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -746583,8 +748341,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -747049,8 +748808,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -747515,8 +749275,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -747981,8 +749742,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -748447,8 +750209,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -748913,8 +750676,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -749379,8 +751143,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -749845,8 +751610,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -750311,8 +752077,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -750777,8 +752544,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -751243,8 +753011,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -751709,8 +753478,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -752175,8 +753945,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -752641,8 +754412,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -753107,8 +754879,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -753573,8 +755346,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -754039,8 +755813,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -754505,8 +756280,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -754971,8 +756747,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -755437,8 +757214,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -755903,8 +757681,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -756369,8 +758148,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -756835,8 +758615,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -757301,8 +759082,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -757767,8 +759549,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -758233,8 +760016,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -758699,8 +760483,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -759165,8 +760950,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -759631,8 +761417,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -760097,8 +761884,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -760563,8 +762351,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -761029,8 +762818,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -761495,8 +763285,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -761961,8 +763752,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -762427,8 +764219,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -762893,8 +764686,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -763359,8 +765153,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -763825,8 +765620,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -764291,8 +766087,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -764757,8 +766554,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -765223,8 +767021,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -765689,8 +767488,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -766155,8 +767955,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -766621,8 +768422,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -767087,8 +768889,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -767553,8 +769356,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -768019,8 +769823,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -768485,8 +770290,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -768951,8 +770757,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -769417,8 +771224,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -769883,8 +771691,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -770349,8 +772158,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -770815,8 +772625,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -771281,8 +773092,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -771747,8 +773559,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -772213,8 +774026,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -772679,8 +774493,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -773145,8 +774960,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -773611,8 +775427,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -774077,8 +775894,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -774543,8 +776361,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -775009,8 +776828,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -775475,8 +777295,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -775941,8 +777762,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -776407,8 +778229,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -776873,8 +778696,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -777339,8 +779163,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -777805,8 +779630,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -778271,8 +780097,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -778737,8 +780564,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -779203,8 +781031,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -779669,8 +781498,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -780135,8 +781965,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -780601,8 +782432,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -781067,8 +782899,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -781533,8 +783366,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
@@ -781999,8 +783833,9 @@
         },
         {
             "techniqueID": "T1590.005",
-            "score": 1,
-            "showSubtechniques": false
+            "score": 0,
+            "showSubtechniques": false,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1546.013",
diff --git a/docs/stories.md b/docs/stories.md
index beffe9d444..c5521588a6 100644
--- a/docs/stories.md
+++ b/docs/stories.md
@@ -284,6 +284,61 @@ _version_: 1
 

   details
 
+### Active Directory Password Spraying
+Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1110.003](https://attack.mitre.org/techniques/T1110.003/)
+- **Last Updated**: 2021-04-07
+
+

+  details
+
+#### Detection Profile
+
+* [Multiple Disabled Users Failing To Authenticate From Host Using Kerberos](detections.md#multiple-disabled-users-failing-to-authenticate-from-host-using-kerberos)
+
+* [Multiple Invalid Users Failing To Authenticate From Host Using Kerberos](detections.md#multiple-invalid-users-failing-to-authenticate-from-host-using-kerberos)
+
+* [Multiple Invalid Users Failing To Authenticate From Host Using NTLM](detections.md#multiple-invalid-users-failing-to-authenticate-from-host-using-ntlm)
+
+* [Multiple Users Attempting To Authenticate Using Explicit Credentials](detections.md#multiple-users-attempting-to-authenticate-using-explicit-credentials)
+
+* [Multiple Users Failing To Authenticate From Host Using Kerberos](detections.md#multiple-users-failing-to-authenticate-from-host-using-kerberos)
+
+* [Multiple Users Failing To Authenticate From Host Using NTLM](detections.md#multiple-users-failing-to-authenticate-from-host-using-ntlm)
+
+* [Multiple Users Failing To Authenticate From Process](detections.md#multiple-users-failing-to-authenticate-from-process)
+
+* [Multiple Users Remotely Failing To Authenticate From Host](detections.md#multiple-users-remotely-failing-to-authenticate-from-host)
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1110.003 | Password Spraying | Credential Access |
+
+#### Kill Chain Phase
+
+* Exploitation
+
+
+#### Reference
+
+* https://attack.mitre.org/techniques/T1110/003/
+
+* https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/
+
+* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)
+
+
+_version_: 1
+

+
+---
+
 ### BITS Jobs
 Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.
 
@@ -712,6 +767,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 
 * [Dump LSASS via procdump Rename](detections.md#dump-lsass-via-procdump-rename)
 
+* [Extract SAM from Registry](detections.md#extract-sam-from-registry)
+
 * [Ntdsutil Export NTDS](detections.md#ntdsutil-export-ntds)
 
 * [Set Default PowerShell Execution Policy To Unrestricted or Bypass](detections.md#set-default-powershell-execution-policy-to-unrestricted-or-bypass)
@@ -749,6 +806,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 
 * Actions on Objectives
 
+* Exploitation
+
 * Installation
 
 
@@ -2549,6 +2608,10 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of
 
 * [Remote Registry Key modifications](detections.md#remote-registry-key-modifications)
 
+* [SLUI RunAs Elevated](detections.md#slui-runas-elevated)
+
+* [SLUI Spawning a Process](detections.md#slui-spawning-a-process)
+
 * [Suspicious Reg exe Process](detections.md#suspicious-reg-exe-process)
 
 * [System Process Running from Unexpected Location](detections.md#system-process-running-from-unexpected-location)
@@ -2779,6 +2842,10 @@ Monitor for activities and techniques associated with maintaining persistence on
 
 * [Sc exe Manipulating Windows Services](detections.md#sc-exe-manipulating-windows-services)
 
+* [Schedule Task with HTTP Command Arguments](detections.md#schedule-task-with-http-command-arguments)
+
+* [Schedule Task with Rundll32 Command Trigger](detections.md#schedule-task-with-rundll32-command-trigger)
+
 * [Schtasks used for forcing a reboot](detections.md#schtasks-used-for-forcing-a-reboot)
 
 * [Setting Credentials via DSInternals modules](detections.md#setting-credentials-via-dsinternals-modules)
@@ -2787,8 +2854,6 @@ Monitor for activities and techniques associated with maintaining persistence on
 
 * [Setting Credentials via PowerSploit modules](detections.md#setting-credentials-via-powersploit-modules)
 
-* [Shedule Task with HTTP Command Arguments](detections.md#shedule-task-with-http-command-arguments)
-
 * [Shim Database File Creation](detections.md#shim-database-file-creation)
 
 * [Shim Database Installation With Suspicious Parameters](detections.md#shim-database-installation-with-suspicious-parameters)
@@ -4606,6 +4671,89 @@ _version_: 2
 
 ---
 
+### DarkSide Ransomware
+Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1003.001](https://attack.mitre.org/techniques/T1003.001/), [T1003.002](https://attack.mitre.org/techniques/T1003.002/), [T1020](https://attack.mitre.org/techniques/T1020/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1055](https://attack.mitre.org/techniques/T1055/), [T1105](https://attack.mitre.org/techniques/T1105/), [T1197](https://attack.mitre.org/techniques/T1197/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1486](https://attack.mitre.org/techniques/T1486/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1548.002](https://attack.mitre.org/techniques/T1548.002/)
+- **Last Updated**: 2020-06-12
+
+

+  details
+
+#### Detection Profile
+
+* [Attempted Credential Dump From Registry via Reg exe](detections.md#attempted-credential-dump-from-registry-via-reg-exe)
+
+* [BITSAdmin Download File](detections.md#bitsadmin-download-file)
+
+* [CMLUA Or CMSTPLUA UAC Bypass](detections.md#cmlua-or-cmstplua-uac-bypass)
+
+* [CertUtil Download With URLCache and Split Arguments](detections.md#certutil-download-with-urlcache-and-split-arguments)
+
+* [CertUtil Download With VerifyCtl and Split Arguments](detections.md#certutil-download-with-verifyctl-and-split-arguments)
+
+* [Cobalt Strike Named Pipes](detections.md#cobalt-strike-named-pipes)
+
+* [Delete ShadowCopy With PowerShell](detections.md#delete-shadowcopy-with-powershell)
+
+* [Detect Mimikatz Using Loaded Images](detections.md#detect-mimikatz-using-loaded-images)
+
+* [Detect PsExec With accepteula Flag](detections.md#detect-psexec-with-accepteula-flag)
+
+* [Detect RClone Command-Line Usage](detections.md#detect-rclone-command-line-usage)
+
+* [Detect Renamed RClone](detections.md#detect-renamed-rclone)
+
+* [Extract SAM from Registry](detections.md#extract-sam-from-registry)
+
+* [Ransomware Notes bulk creation](detections.md#ransomware-notes-bulk-creation)
+
+* [SLUI RunAs Elevated](detections.md#slui-runas-elevated)
+
+* [SLUI Spawning a Process](detections.md#slui-spawning-a-process)
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1003.002 | Security Account Manager | Credential Access |
+| T1197 | BITS Jobs | Defense Evasion, Persistence |
+| T1105 | Ingress Tool Transfer | Command and Control |
+| T1218.003 | CMSTP | Defense Evasion |
+| T1055 | Process Injection | Defense Evasion, Privilege Escalation |
+| T1490 | Inhibit System Recovery | Impact |
+| T1003.001 | LSASS Memory | Credential Access |
+| T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
+| T1020 | Automated Exfiltration | Exfiltration |
+| T1486 | Data Encrypted for Impact | Impact |
+| T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+
+#### Kill Chain Phase
+
+* Actions on Objectives
+
+* Exfiltration
+
+* Exploitation
+
+* Obfuscation
+
+
+#### Reference
+
+* https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
+
+* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+
+
+_version_: 1
+

+
+---
+
 ### Dynamic DNS
 Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists.
 
@@ -4855,7 +5003,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint, Network_Traffic
-- **ATT&CK**: [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1036.003](https://attack.mitre.org/techniques/T1036.003/), [T1047](https://attack.mitre.org/techniques/T1047/), [T1048](https://attack.mitre.org/techniques/T1048/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1070](https://attack.mitre.org/techniques/T1070/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1071.001](https://attack.mitre.org/techniques/T1071.001/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1547.001](https://attack.mitre.org/techniques/T1547.001/)
+- **ATT&CK**: [T1020](https://attack.mitre.org/techniques/T1020/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1036.003](https://attack.mitre.org/techniques/T1036.003/), [T1047](https://attack.mitre.org/techniques/T1047/), [T1048](https://attack.mitre.org/techniques/T1048/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1070](https://attack.mitre.org/techniques/T1070/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1071.001](https://attack.mitre.org/techniques/T1071.001/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1547.001](https://attack.mitre.org/techniques/T1547.001/)
 - **Last Updated**: 2020-02-04
 
 

@@ -4865,12 +5013,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [BCDEdit Failure Recovery Modification](detections.md#bcdedit-failure-recovery-modification)
 
+* [CMLUA Or CMSTPLUA UAC Bypass](detections.md#cmlua-or-cmstplua-uac-bypass)
+
 * [Common Ransomware Extensions](detections.md#common-ransomware-extensions)
 
 * [Common Ransomware Notes](detections.md#common-ransomware-notes)
 
 * [Deleting Shadow Copies](detections.md#deleting-shadow-copies)
 
+* [Detect RClone Command-Line Usage](detections.md#detect-rclone-command-line-usage)
+
+* [Detect Renamed RClone](detections.md#detect-renamed-rclone)
+
 * [Prohibited Network Traffic Allowed](detections.md#prohibited-network-traffic-allowed)
 
 * [Registry Keys Used For Persistence](detections.md#registry-keys-used-for-persistence)
@@ -4915,7 +5069,9 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1490 | Inhibit System Recovery | Impact |
+| T1218.003 | CMSTP | Defense Evasion |
 | T1485 | Data Destruction | Impact |
+| T1020 | Automated Exfiltration | Exfiltration |
 | T1482 | Domain Trust Discovery | Discovery |
 | T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
 | T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation |
@@ -4940,6 +5096,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * Delivery
 
+* Exfiltration
+
 * Exploitation
 
 * Privilege Escalation
@@ -5049,7 +5207,9 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1490 | Inhibit System Recovery | Impact |
+| T1218.003 | CMSTP | Defense Evasion |
 | T1485 | Data Destruction | Impact |
+| T1020 | Automated Exfiltration | Exfiltration |
 | T1482 | Domain Trust Discovery | Discovery |
 | T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
 | T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation |
@@ -5169,6 +5329,84 @@ Leverage searches that allow you to detect and investigate unusual activities th
 * https://thehackernews.com/2018/07/samsam-ransomware-attacks.html
 
 
+_version_: 1
+

+
+---
+
+### Trickbot
+Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1027](https://attack.mitre.org/techniques/T1027/), [T1053](https://attack.mitre.org/techniques/T1053/), [T1055](https://attack.mitre.org/techniques/T1055/), [T1059](https://attack.mitre.org/techniques/T1059/), [T1087.002](https://attack.mitre.org/techniques/T1087.002/), [T1218.011](https://attack.mitre.org/techniques/T1218.011/), [T1562.001](https://attack.mitre.org/techniques/T1562.001/), [T1566.001](https://attack.mitre.org/techniques/T1566.001/), [T1590.005](https://attack.mitre.org/techniques/T1590.005/)
+- **Last Updated**: 2021-04-20
+
+

+  details
+
+#### Detection Profile
+
+* [Account Discovery With Net App](detections.md#account-discovery-with-net-app)
+
+* [Attempt To Stop Security Service](detections.md#attempt-to-stop-security-service)
+
+* [Cobalt Strike Named Pipes](detections.md#cobalt-strike-named-pipes)
+
+* [Office Application Spawn rundll32 process](detections.md#office-application-spawn-rundll32-process)
+
+* [Office Document Executing Macro Code](detections.md#office-document-executing-macro-code)
+
+* [Powershell Remote Thread To Known Windows Process](detections.md#powershell-remote-thread-to-known-windows-process)
+
+* [Schedule Task with Rundll32 Command Trigger](detections.md#schedule-task-with-rundll32-command-trigger)
+
+* [Suspicious Rundll32 StartW](detections.md#suspicious-rundll32-startw)
+
+* [Trickbot Named Pipe](detections.md#trickbot-named-pipe)
+
+* [Wermgr Process Connecting To IP Check Web Services](detections.md#wermgr-process-connecting-to-ip-check-web-services)
+
+* [Wermgr Process Create Executable File](detections.md#wermgr-process-create-executable-file)
+
+* [Wermgr Process Spawned CMD Or Powershell Process](detections.md#wermgr-process-spawned-cmd-or-powershell-process)
+
+* [Write Executable in SMB Share](detections.md#write-executable-in-smb-share)
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1087.002 | Domain Account | Discovery |
+| T1562.001 | Disable or Modify Tools | Defense Evasion |
+| T1055 | Process Injection | Defense Evasion, Privilege Escalation |
+| T1566.001 | Spearphishing Attachment | Initial Access |
+| T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+| T1218.011 | Rundll32 | Defense Evasion |
+| T1590.005 | IP Addresses | Reconnaissance |
+| T1027 | Obfuscated Files or Information | Defense Evasion |
+| T1059 | Command and Scripting Interpreter | Execution |
+| T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
+
+#### Kill Chain Phase
+
+* Actions on Objectives
+
+* Exploitation
+
+* Installation
+
+* Lateral Movement
+
+
+#### Reference
+
+* https://en.wikipedia.org/wiki/Trickbot
+
+* https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/
+
+
 _version_: 1
 

 
diff --git a/docs/stories.wiki b/docs/stories.wiki
index a6cd9aead8..30a647abbe 100644
--- a/docs/stories.wiki
+++ b/docs/stories.wiki
@@ -346,6 +346,69 @@ Monitor your environment for activity consistent with common attack techniques b
 ==Adversary Tactics==
 
 
+===Active directory password spraying===
+Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110.003/ T1110.003]
+* '''Last Updated''': 2021-04-07
+
+

+

+
+====Detection Profile====
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos|Multiple Disabled Users Failing To Authenticate From Host Using Kerberos]]
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos|Multiple Invalid Users Failing To Authenticate From Host Using Kerberos]]
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm|Multiple Invalid Users Failing To Authenticate From Host Using NTLM]]
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_users_attempting_to_authenticate_using_explicit_credentials|Multiple Users Attempting To Authenticate Using Explicit Credentials]]
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_host_using_kerberos|Multiple Users Failing To Authenticate From Host Using Kerberos]]
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_host_using_ntlm|Multiple Users Failing To Authenticate From Host Using NTLM]]
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_process|Multiple Users Failing To Authenticate From Process]]
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_users_remotely_failing_to_authenticate_from_host|Multiple Users Remotely Failing To Authenticate From Host]]
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1110.003
+| Password Spraying
+| Credential Access
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Reference====
+
+* https://attack.mitre.org/techniques/T1110/003/
+
+* https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/
+
+* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)
+
+
+''version'': 1
+

+

+
+----
+
 ===Bits jobs===
 Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.
 
@@ -897,6 +960,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 
 * [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_procdump_rename|Dump LSASS via procdump Rename]]
 
+* [[Documentation:ESSOC:detections:Detections#Extract_sam_from_registry|Extract SAM from Registry]]
+
 * [[Documentation:ESSOC:detections:Detections#Ntdsutil_export_ntds|Ntdsutil Export NTDS]]
 
 * [[Documentation:ESSOC:detections:Detections#Set_default_powershell_execution_policy_to_unrestricted_or_bypass|Set Default PowerShell Execution Policy To Unrestricted or Bypass]]
@@ -1001,6 +1066,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 
 * Actions on Objectives
 
+* Exploitation
+
 * Installation
 
 
@@ -3376,6 +3443,10 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of
 
 * [[Documentation:ESSOC:detections:Detections#Remote_registry_key_modifications|Remote Registry Key modifications]]
 
+* [[Documentation:ESSOC:detections:Detections#Slui_runas_elevated|SLUI RunAs Elevated]]
+
+* [[Documentation:ESSOC:detections:Detections#Slui_spawning_a_process|SLUI Spawning a Process]]
+
 * [[Documentation:ESSOC:detections:Detections#Suspicious_reg_exe_process|Suspicious Reg exe Process]]
 
 * [[Documentation:ESSOC:detections:Detections#System_process_running_from_unexpected_location|System Process Running from Unexpected Location]]
@@ -3741,6 +3812,10 @@ Monitor for activities and techniques associated with maintaining persistence on
 
 * [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
 
+* [[Documentation:ESSOC:detections:Detections#Schedule_task_with_http_command_arguments|Schedule Task with HTTP Command Arguments]]
+
+* [[Documentation:ESSOC:detections:Detections#Schedule_task_with_rundll32_command_trigger|Schedule Task with Rundll32 Command Trigger]]
+
 * [[Documentation:ESSOC:detections:Detections#Schtasks_used_for_forcing_a_reboot|Schtasks used for forcing a reboot]]
 
 * [[Documentation:ESSOC:detections:Detections#Setting_credentials_via_dsinternals_modules|Setting Credentials via DSInternals modules]]
@@ -3749,8 +3824,6 @@ Monitor for activities and techniques associated with maintaining persistence on
 
 * [[Documentation:ESSOC:detections:Detections#Setting_credentials_via_powersploit_modules|Setting Credentials via PowerSploit modules]]
 
-* [[Documentation:ESSOC:detections:Detections#Shedule_task_with_http_command_arguments|Shedule Task with HTTP Command Arguments]]
-
 * [[Documentation:ESSOC:detections:Detections#Shim_database_file_creation|Shim Database File Creation]]
 
 * [[Documentation:ESSOC:detections:Detections#Shim_database_installation_with_suspicious_parameters|Shim Database Installation With Suspicious Parameters]]
@@ -5986,6 +6059,127 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 
 ----
 
+===Darkside ransomware===
+Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+* '''Last Updated''': 2020-06-12
+
+

+

+
+====Detection Profile====
+
+* [[Documentation:ESSOC:detections:Detections#Attempted_credential_dump_from_registry_via_reg_exe|Attempted Credential Dump From Registry via Reg exe]]
+
+* [[Documentation:ESSOC:detections:Detections#Bitsadmin_download_file|BITSAdmin Download File]]
+
+* [[Documentation:ESSOC:detections:Detections#Cmlua_or_cmstplua_uac_bypass|CMLUA Or CMSTPLUA UAC Bypass]]
+
+* [[Documentation:ESSOC:detections:Detections#Certutil_download_with_urlcache_and_split_arguments|CertUtil Download With URLCache and Split Arguments]]
+
+* [[Documentation:ESSOC:detections:Detections#Certutil_download_with_verifyctl_and_split_arguments|CertUtil Download With VerifyCtl and Split Arguments]]
+
+* [[Documentation:ESSOC:detections:Detections#Cobalt_strike_named_pipes|Cobalt Strike Named Pipes]]
+
+* [[Documentation:ESSOC:detections:Detections#Delete_shadowcopy_with_powershell|Delete ShadowCopy With PowerShell]]
+
+* [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_using_loaded_images|Detect Mimikatz Using Loaded Images]]
+
+* [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
+
+* [[Documentation:ESSOC:detections:Detections#Detect_rclone_command-line_usage|Detect RClone Command-Line Usage]]
+
+* [[Documentation:ESSOC:detections:Detections#Detect_renamed_rclone|Detect Renamed RClone]]
+
+* [[Documentation:ESSOC:detections:Detections#Extract_sam_from_registry|Extract SAM from Registry]]
+
+* [[Documentation:ESSOC:detections:Detections#Ransomware_notes_bulk_creation|Ransomware Notes bulk creation]]
+
+* [[Documentation:ESSOC:detections:Detections#Slui_runas_elevated|SLUI RunAs Elevated]]
+
+* [[Documentation:ESSOC:detections:Detections#Slui_spawning_a_process|SLUI Spawning a Process]]
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1003.002
+| Security Account Manager
+| Credential Access
+|-
+| T1197
+| BITS Jobs
+| Defense Evasion, Persistence
+|-
+| T1105
+| Ingress Tool Transfer
+| Command and Control
+|-
+| T1218.003
+| CMSTP
+| Defense Evasion
+|-
+| T1055
+| Process Injection
+| Defense Evasion, Privilege Escalation
+|-
+| T1490
+| Inhibit System Recovery
+| Impact
+|-
+| T1003.001
+| LSASS Memory
+| Credential Access
+|-
+| T1021.002
+| SMB/Windows Admin Shares
+| Lateral Movement
+|-
+| T1020
+| Automated Exfiltration
+| Exfiltration
+|-
+| T1486
+| Data Encrypted for Impact
+| Impact
+|-
+| T1548.002
+| Bypass User Account Control
+| Defense Evasion, Privilege Escalation
+|}
+
+
+====Kill Chain Phase====
+
+* Actions on Objectives
+
+* Exfiltration
+
+* Exploitation
+
+* Obfuscation
+
+
+====Reference====
+
+* https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
+
+* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+
+
+''version'': 1
+

+

+
+----
+
 ===Dynamic dns===
 Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists.
 
@@ -6327,7 +6521,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Traffic
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1489/ T1489]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1489/ T1489]
 * '''Last Updated''': 2020-02-04
 
 

@@ -6337,12 +6531,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Bcdedit_failure_recovery_modification|BCDEdit Failure Recovery Modification]]
 
+* [[Documentation:ESSOC:detections:Detections#Cmlua_or_cmstplua_uac_bypass|CMLUA Or CMSTPLUA UAC Bypass]]
+
 * [[Documentation:ESSOC:detections:Detections#Common_ransomware_extensions|Common Ransomware Extensions]]
 
 * [[Documentation:ESSOC:detections:Detections#Common_ransomware_notes|Common Ransomware Notes]]
 
 * [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]
 
+* [[Documentation:ESSOC:detections:Detections#Detect_rclone_command-line_usage|Detect RClone Command-Line Usage]]
+
+* [[Documentation:ESSOC:detections:Detections#Detect_renamed_rclone|Detect Renamed RClone]]
+
 * [[Documentation:ESSOC:detections:Detections#Prohibited_network_traffic_allowed|Prohibited Network Traffic Allowed]]
 
 * [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
@@ -6393,10 +6593,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Inhibit System Recovery
 | Impact
 |-
+| T1218.003
+| CMSTP
+| Defense Evasion
+|-
 | T1485
 | Data Destruction
 | Impact
 |-
+| T1020
+| Automated Exfiltration
+| Exfiltration
+|-
 | T1482
 | Domain Trust Discovery
 | Discovery
@@ -6467,6 +6675,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * Delivery
 
+* Exfiltration
+
 * Exploitation
 
 * Privilege Escalation
@@ -6539,7 +6749,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Traffic
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1489/ T1489]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1489/ T1489]
 * '''Last Updated''': 2020-11-06
 
 

@@ -6591,10 +6801,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Inhibit System Recovery
 | Impact
 |-
+| T1218.003
+| CMSTP
+| Defense Evasion
+|-
 | T1485
 | Data Destruction
 | Impact
 |-
+| T1020
+| Automated Exfiltration
+| Exfiltration
+|-
 | T1482
 | Domain Trust Discovery
 | Discovery
@@ -6786,6 +7004,119 @@ Leverage searches that allow you to detect and investigate unusual activities th
 * https://thehackernews.com/2018/07/samsam-ransomware-attacks.html
 
 
+''version'': 1
+

+

+
+----
+
+===Trickbot===
+Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087.002/ T1087.002], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1566.001/ T1566.001], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1590.005/ T1590.005], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1021.002/ T1021.002]
+* '''Last Updated''': 2021-04-20
+
+

+

+
+====Detection Profile====
+
+* [[Documentation:ESSOC:detections:Detections#Account_discovery_with_net_app|Account Discovery With Net App]]
+
+* [[Documentation:ESSOC:detections:Detections#Attempt_to_stop_security_service|Attempt To Stop Security Service]]
+
+* [[Documentation:ESSOC:detections:Detections#Cobalt_strike_named_pipes|Cobalt Strike Named Pipes]]
+
+* [[Documentation:ESSOC:detections:Detections#Office_application_spawn_rundll32_process|Office Application Spawn rundll32 process]]
+
+* [[Documentation:ESSOC:detections:Detections#Office_document_executing_macro_code|Office Document Executing Macro Code]]
+
+* [[Documentation:ESSOC:detections:Detections#Powershell_remote_thread_to_known_windows_process|Powershell Remote Thread To Known Windows Process]]
+
+* [[Documentation:ESSOC:detections:Detections#Schedule_task_with_rundll32_command_trigger|Schedule Task with Rundll32 Command Trigger]]
+
+* [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_startw|Suspicious Rundll32 StartW]]
+
+* [[Documentation:ESSOC:detections:Detections#Trickbot_named_pipe|Trickbot Named Pipe]]
+
+* [[Documentation:ESSOC:detections:Detections#Wermgr_process_connecting_to_ip_check_web_services|Wermgr Process Connecting To IP Check Web Services]]
+
+* [[Documentation:ESSOC:detections:Detections#Wermgr_process_create_executable_file|Wermgr Process Create Executable File]]
+
+* [[Documentation:ESSOC:detections:Detections#Wermgr_process_spawned_cmd_or_powershell_process|Wermgr Process Spawned CMD Or Powershell Process]]
+
+* [[Documentation:ESSOC:detections:Detections#Write_executable_in_smb_share|Write Executable in SMB Share]]
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1087.002
+| Domain Account
+| Discovery
+|-
+| T1562.001
+| Disable or Modify Tools
+| Defense Evasion
+|-
+| T1055
+| Process Injection
+| Defense Evasion, Privilege Escalation
+|-
+| T1566.001
+| Spearphishing Attachment
+| Initial Access
+|-
+| T1053
+| Scheduled Task/Job
+| Execution, Persistence, Privilege Escalation
+|-
+| T1218.011
+| Rundll32
+| Defense Evasion
+|-
+| T1590.005
+| IP Addresses
+| Reconnaissance
+|-
+| T1027
+| Obfuscated Files or Information
+| Defense Evasion
+|-
+| T1059
+| Command and Scripting Interpreter
+| Execution
+|-
+| T1021.002
+| SMB/Windows Admin Shares
+| Lateral Movement
+|}
+
+
+====Kill Chain Phase====
+
+* Actions on Objectives
+
+* Exploitation
+
+* Installation
+
+* Lateral Movement
+
+
+====Reference====
+
+* https://en.wikipedia.org/wiki/Trickbot
+
+* https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/
+
+
 ''version'': 1
 

 

@@ -7290,7 +7621,7 @@ Reduce the risk of CVE-2018-11409, an information disclosure vulnerability withi
 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
-# On Date: 2021-04-29 21:24:37.285211 UTC
+# On Date: 2021-05-13 22:00:22.199260 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############